Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update transitive gin-tonic/gin, fixes #64 #74

Closed
wants to merge 1 commit into from

Conversation

Jacalz
Copy link
Contributor

@Jacalz Jacalz commented Mar 23, 2022

There doesn't seem to be much movement upstream on this.
Let's update our transitive dependecy in the meantime.

Fixes #64

There doesn't seem to be much movement upstream on this.
Let's update our transitive dependecy in the meantime.
@psanford
Copy link
Owner

I don't see much point in doing this. This is a test only dependency used by one of our dependencies. We don't link to gin at all. We are not vulnerable to CVE-2020-28483.

@Jacalz
Copy link
Contributor Author

Jacalz commented Mar 25, 2022

Indeed, we are not vulnerable to the CVE. However, as there isn’t much work happening upstream, I wanted to at least get rid of the warning.

I am also getting security warnings on GitHub because of this and I suspect that anyone else using this project probably also get those warnings. They might not know that the issue doesn’t affect us.

Either way, this was just a suggestion to fix the warning. Feel free to close it if you don't think it's worth it.

@Jacalz
Copy link
Contributor Author

Jacalz commented May 15, 2022

I guess I'll close this then. Feel free to reopen and merge if you have changed your mind.

@Jacalz Jacalz closed this May 15, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Upgrade nhooyr.io/websocket to get gin upgrade
2 participants