Merge branch 'feature/fix-audit'

ONSdigital · Jun 23, 2023 · 3c9a90b · 3c9a90b
2 parents ba58865 + 2c9edad
commit 3c9a90b
Show file tree

Hide file tree

Showing 5 changed files with 933 additions and 53 deletions.
diff --git a/ci/build.yml b/ci/build.yml
@@ -6,7 +6,7 @@ image_resource:
   type: docker-image
   source:
     repository: golang
-    tag: latest
+    tag: 1.19.2
 
 inputs:
   - name: dp-mongodb-in-memory

diff --git a/ci/lint.yml b/ci/lint.yml
@@ -6,7 +6,7 @@ image_resource:
   type: docker-image
   source:
     repository: golang
-    tag: latest
+    tag: 1.19.2
 
 inputs:
   - name: dp-mongodb-in-memory

diff --git a/ci/unit.yml b/ci/unit.yml
@@ -6,7 +6,8 @@ image_resource:
   type: docker-image
   source:
     repository: golang
-    tag: latest
+    tag: 1.19.2
+# tag specific version to avoid: error while loading shared libraries: libcrypto.so.1.1  for later versions
 
 inputs:
   - name: dp-mongodb-in-memory

diff --git a/go.mod b/go.mod
@@ -2,12 +2,15 @@ module github.com/ONSdigital/dp-mongodb-in-memory
 
 go 1.19
 
+// to fix: [CVE-2023-32731] CWE-Other
+replace google.golang.org/grpc => google.golang.org/grpc v1.55.0
+
 require (
 	github.com/ONSdigital/log.go/v2 v2.4.1
 	github.com/smartystreets/goconvey v1.8.0
 	github.com/spf13/afero v1.9.5
 	go.mongodb.org/mongo-driver v1.11.4
-	golang.org/x/crypto v0.8.0
+	golang.org/x/crypto v0.10.0
 )
 
 require (
@@ -29,8 +32,8 @@ require (
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a // indirect
 	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/sys v0.7.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/sys v0.9.0 // indirect
+	golang.org/x/text v0.10.0 // indirect
 )
 
 retract (