Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[7.17](backport #4367) Bump ristretto to v0.2.0 #4375

Merged
merged 1 commit into from
Jan 30, 2025

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented Jan 30, 2025

What is the problem this PR solves?

This fixes CVE-2024-45339.

How does this PR solve the problem?

By updating ristretto to a version that doesn't depend on glog.


This is an automatic backport of pull request #4367 done by [Mergify](https://mergify.com).

@mergify mergify bot added the backport label Jan 30, 2025
@mergify mergify bot requested a review from a team as a code owner January 30, 2025 08:54
@mergify mergify bot added the conflicts There is a conflict in the backported pull request label Jan 30, 2025
@mergify mergify bot requested review from blakerouse and kaanyalti January 30, 2025 08:54
Copy link
Contributor Author

mergify bot commented Jan 30, 2025

Cherry-pick of de20ff0 has failed:

On branch mergify/bp/7.17/pr-4367
Your branch is up to date with 'origin/7.17'.

You are currently cherry-picking commit de20ff0.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	both modified:   NOTICE.txt
	both modified:   go.mod
	both modified:   go.sum
	deleted by us:   testing/go.mod
	deleted by us:   testing/go.sum

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@swiatekm swiatekm force-pushed the mergify/bp/7.17/pr-4367 branch from 51c23c0 to b60f993 Compare January 30, 2025 09:39
This fixes  CVE-2024-45339.

(cherry picked from commit de20ff0)

# Conflicts:
#	NOTICE.txt
#	go.mod
#	go.sum
#	testing/go.mod
#	testing/go.sum
@swiatekm swiatekm force-pushed the mergify/bp/7.17/pr-4367 branch from b60f993 to 0a63f67 Compare January 30, 2025 09:44
@swiatekm swiatekm removed the conflicts There is a conflict in the backported pull request label Jan 30, 2025
@swiatekm
Copy link
Contributor

golangci-lint fails because the runners gets killed. Most likely an OOMkill, as it tends to eat too much memory when dependencies are updated. I'm going to merge in spite of the failure and debug it independently.

@swiatekm swiatekm merged commit ca44f39 into 7.17 Jan 30, 2025
5 of 6 checks passed
@swiatekm swiatekm deleted the mergify/bp/7.17/pr-4367 branch January 30, 2025 13:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant