Security vulnerabilities on golang.org/x/net

[navas-op]

Security vulnerabilities on golang.org/x/net/http2 v0.17.0
Which have been fixed on fixed in 0.23.0.

GHSA-4v7x-pqxf-cx7m

golang.org/x/net is being pulled here which includes http2 as well.
golang.org/x/net v0.17.0 // indirect
https://github.com/helm/helm/blob/main/go.mod#L150

Can this package be upgraded?

[gjenkins8]

Helm doesn't serve (http2 connections). I don't believe it is affected by this CVE. Please work with your vendor (presumably) to reduce false positives.

[navas-op]

May be helm is not directly pulling this dependency. But it could be pulled from https://github.com/helm/helm/blob/main/go.mod#L150 indirect right?

When I do a go mod download on go.mod I can see http2 getting downloaded in ${HOME}/go/pkg/mod/golang.org/x/net@v0.17.0/http2