fix(deps): switch to github.com/anchore/archiver/v3 #1544
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Jun 13, 2024
dcaravel
added
the
generate-dumps-on-pr
dcaravel
reviewed
Jun 14, 2024
RTann
force-pushed
the
ross-anchore-archiver-3.5.2
branch
from
393fb6b to
25552d9
Compare
|
/retest |
dcaravel
approved these changes
Jun 17, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
github.com/mholt/archiver/v3 v3.51.1 is affected by CVE-2024-0406. There is a PR in-progress to resolve this, but it has been rather inactive lately.
We are not affected by this vulnerability, as it affects a codepath which we do not use.
I previously decided to remove the #1472 dependency by copying functions over to this repository. However, I ran into issues with CI I have not really been wanting to resolve in that PR, and I believe this approach is safer.
In this approach, we replace github.com/mholt/archiver/v3 v3.51.1 with github.com/anchore/archiver/v3 v3.51.2. See mholt/archiver@v3.5.1...anchore:archiver:v3.5.2 for the exact details. It is clear the only difference is the contents of the previously mentioned PR, which does not affect our codepath.
Note 1: This uses the
replacedirective instead of actually completely replacing the dependency due to annoying circular dependency things with thestackrox/stackroxrepo.Note 2: This will not resolve the vulnerability match in the
stackrox/stackroxrepo, asreplaceis only used when thego.modin this repo is the main module. So, we will have toreplacein thestackrox/stackroxrepo, too