Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump dependencies and add notes about Go releases we support #2336

Merged
merged 1 commit into from Nov 12, 2022

Conversation

aldas
Copy link
Contributor

@aldas aldas commented Nov 12, 2022

Bump dependencies and add notes about Go releases we support. golang.org/x/ libraries do not work with Go 1.16 so we are bumping oldest version to Go 1.17. List of golang.org/x vuln is here https://pkg.go.dev/search?q=golang.org%2Fx&m=vuln

This is mostly done because we used version of testify that uses yaml library that is vulnerable. There are companies which security policies that disallow using libraries (even test) that have vulnerable dependencies. This case Echo is not using any of yaml stuff, even in tests but we still depend on those libraries.

related to #2326

@codecov
Copy link

codecov bot commented Nov 12, 2022

Codecov Report

Base: 92.35% // Head: 92.37% // Increases project coverage by +0.01% 🎉

Coverage data is based on head (9f6a607) compared to base (8f2bf82).
Patch has no changes to coverable lines.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #2336      +/-   ##
==========================================
+ Coverage   92.35%   92.37%   +0.01%     
==========================================
  Files          37       37              
  Lines        4436     4446      +10     
==========================================
+ Hits         4097     4107      +10     
  Misses        247      247              
  Partials       92       92              
Impacted Files Coverage Δ
middleware/proxy.go 68.66% <0.00%> (+2.23%) ⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

@aldas aldas merged commit b010b69 into labstack:master Nov 12, 2022
@aldas aldas deleted the bump_deps branch November 12, 2022 19:52
@aldas aldas mentioned this pull request Dec 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant