Github/temporal
1
0
Fork 0
mirror of https://github.com/temporalio/temporal.git synced 2026-08-30 18:41:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Pull in protojson vuln fixes (#5267)

Browse Source 
## What was changed

I bumped the version of api-go and sdk-go and _slightly_ altered our
nettest RPC factory interface to deal with changes in v1.60.0 of go-grpc

## Why?

To fix the protojson DOS vulns recently patched in the upstream
golang/protobuf. See https://github.com/temporalio/api-go/pull/143 for
details

## How did you test it?

I pulled the tests added to the protojson repo into our fork

## Potential risks

N/A

## Is hotfix candidate?

No as it requires all our other proto changes which aren't released
This commit is contained in:
Tim Deeb-Swihart
2024-01-08 14:41:00 -08:00
committed by GitHub
parent bcdb99ab32
commit 6a4450f1a6
5 changed files with 57 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
develop/buildkite/third_party_deps.txt
View File

@@ -385,8 +385,6 @@ golang.org/x/text/unicode/bidi
golang.org/x/text/unicode/norm
golang.org/x/text/width
golang.org/x/time/rate
golang.org/x/xerrors
golang.org/x/xerrors/internal
google.golang.org/api/googleapi
google.golang.org/api/googleapi/transport
google.golang.org/api/iamcredentials/v1
@@ -460,6 +458,7 @@ google.golang.org/grpc/internal/metadata
google.golang.org/grpc/internal/pretty
google.golang.org/grpc/internal/resolver
google.golang.org/grpc/internal/resolver/dns
google.golang.org/grpc/internal/resolver/dns/internal
google.golang.org/grpc/internal/resolver/passthrough
google.golang.org/grpc/internal/resolver/unix
google.golang.org/grpc/internal/serviceconfig
@@ -474,6 +473,7 @@ google.golang.org/grpc/reflection
google.golang.org/grpc/reflection/grpc_reflection_v1
google.golang.org/grpc/reflection/grpc_reflection_v1alpha
google.golang.org/grpc/resolver
google.golang.org/grpc/resolver/dns
google.golang.org/grpc/resolver/manual
google.golang.org/grpc/serviceconfig
google.golang.org/grpc/stats