CVE-2022-24921 - yq built with go1.17.7

[Bhavnit34]

Describe the bug

When installing yq 4.23.1 I've noticed that the binary has been built using go1.17.7 and therefore is vulnerable to CVE-2022-24921, even though 8cb2422 had bumped the go version to 1.18 before 4.23.1 was released.

Version of yq: 4.23.1
Operating system: mac and linux
Installed via: release page

I have tested this on https://github.com/mikefarah/yq/releases/download/v4.23.1/yq_darwin_amd64 , https://github.com/mikefarah/yq/releases/download/v4.23.1/yq_linux_amd64 and https://github.com/mikefarah/yq/releases/download/v4.23.1/yq_linux_s390x

❯ strings yq | grep go1.
h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
go1.17.7

[mikefarah]

Oh I see - dependabot updated the docker images, but not the git release workflow - will fix for next release

[mikefarah]

Fixed in 4.24.2