fix: security issues #464
Merged
fix: security issues #464
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
odubajDT
requested review from
AlexsJones,
james-milligan,
toddbaert and
Kavindu-Dodan
as code owners
Codecov Report
@@ Coverage Diff @@
## main #464 +/- ##
==========================================
- Coverage 62.26% 62.24% -0.03%
==========================================
Files 13 13
Lines 1659 1658 -1
==========================================
- Hits 1033 1032 -1
Misses 563 563
Partials 63 63
📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
Kavindu-Dodan
approved these changes
Mar 3, 2023
Signed-off-by: odubajDT <[email protected]>
Signed-off-by: odubajDT <[email protected]>
Signed-off-by: odubajDT <[email protected]>
odubajDT
force-pushed
the
fix/321/security
branch
from
a4ea3b5 to
b6c6319
Compare
toddbaert
reviewed
Mar 6, 2023
toddbaert
approved these changes
Mar 6, 2023
There was a problem hiding this comment.
TBH this is definitely a false positive security issue. The hash isn't being used here for anything security related, just to reduce un-needed cycles if the HTTP contents haven't changed.
That said, if switching to sha256 save us some false positive warnings in tools I think it's a good change.
Co-authored-by: Todd Baert <[email protected]> Signed-off-by: odubajDT <[email protected]>
beeme1mr
pushed a commit
that referenced
this pull request
Mar 7, 2023
🤖 I have created a release *beep* *boop* --- ## [0.4.1](v0.4.0...v0.4.1) (2023-03-07) ### 🔄 Refactoring * remove unused struct field ([#458](#458)) ([a04c0b8](a04c0b8)) ### 🧹 Chore * **deps:** update sigstore/cosign-installer digest to bd2d118 ([#471](#471)) ([ee90f48](ee90f48)) ### 🐛 Bug Fixes * **deps:** update module github.com/open-feature/go-sdk-contrib/providers/flagd to v0.1.10 ([#459](#459)) ([cbdf9b0](cbdf9b0)) * **deps:** update module golang.org/x/net to v0.8.0 ([#468](#468)) ([10d5f2c](10d5f2c)) * fix broken image signing ([#461](#461)) ([05bb51c](05bb51c)) * fixing image delimeter ([#463](#463)) ([b4ee495](b4ee495)) * security issues ([#464](#464)) ([7f1e759](7f1e759)) * set readiness once only ([#465](#465)) ([41a888d](41a888d)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR
Related Issues
Fixes #321