Bump gopkg.in/yaml.v2 to v2.2.3 #1188
Merged
+3
−3
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes susceptibility to billion laughs attack, see GitLab Gemnasium advisory for details https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/d769b9b5f0ae0c94bba8de1f67f19d6d0cfe630a/go/gopkg.in/yaml.v2/GMS-2019-2.yml
theoretick
requested review from
saschagrunert and
asahasrabuddhe
and removed request for
a team
rliebz
approved these changes
Sep 20, 2020
|
@saschagrunert @asahasrabuddhe would either of you have a chance to review this minor dependency bump? |
|
@rliebz I see there is also a check failing for Codecov, should I be concerned about that or is there any additional actions needed here? Looks like it's failing in the other PRs as well |
|
@theoretick Nope, it's not a required check. Totally fine to ignore. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
Bumps patch version to address
gopkg.in/yaml.v2vulnerability making library susceptible to billion laughs attackWhat this PR does / why we need it:
https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/d769b9b5f0ae0c94bba8de1f67f19d6d0cfe630a/go/gopkg.in/yaml.v2/GMS-2019-2.yml
I took a look through the yaml loader module and I do not think the library is high risk of this flaw due to the inherent risks of untrusted user input, but it should likely be bumped to at least the fixed patch version to mitigate. While I deemed it low-risk, my apologies for the full disclosure here if not preferred. I did not find a security disclosure policy or contribution docs, but it would be excellent if a policy could be documented as a side-effect to this pull request.
Which issue(s) this PR fixes:
No open issue.
Special notes for your reviewer:
I bumped to only the minimum version to address the existing vulnerability, but happy to go to the latest patch (looks like
v.2.3.0) if desired!Testing
go test passes but no additional test cases ran.
Release Notes