Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/crypto: requires old version of x/net #57245

Closed
duncanharris opened this issue Dec 11, 2022 · 2 comments
Closed

x/crypto: requires old version of x/net #57245

duncanharris opened this issue Dec 11, 2022 · 2 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Unreleased

Comments

@duncanharris
Copy link

Latest golang.org/x/crypto requires v0.3.0 of golang.org/x/net but the latest of the latter is v0.4.0

https://cs.opensource.google/go/x/crypto/+/master:go.mod :

module golang.org/x/crypto

go 1.17

require (
	golang.org/x/net v0.3.0
	golang.org/x/sys v0.3.0
	golang.org/x/term v0.3.0
)

require golang.org/x/text v0.5.0 // indirect

Highlighted because seems to cause my vulnerability checker to report an issue.
@gopherbot gopherbot added this to the Unreleased milestone Dec 11, 2022
@seankhliao seankhliao changed the title x/crypto requires old version of x/net x/crypto: requires old version of x/net Dec 11, 2022
@seankhliao
Copy link
Member

cc @golang/release

@seankhliao seankhliao added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Dec 11, 2022
@heschi
Copy link
Contributor

heschi commented Dec 12, 2022

Nothing in crypto uses the vulnerable package in net, so I would consider this a false positive from the vulnerability checker. The dependency will be updated in a few weeks when the next versions are tagged, and in the meantime you can upgrade yourself if you want.

@heschi heschi closed this as not planned Won't fix, can't repro, duplicate, stale Dec 12, 2022
@golang golang locked and limited conversation to collaborators Dec 12, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
4 participants
@duncanharris @gopherbot @seankhliao @heschi