Skip to content
This repository has been archived by the owner on Oct 10, 2023. It is now read-only.

Move satori/go.uuid to google/uuid #1543

Closed
2 tasks done
PushkarJ opened this issue Jan 24, 2022 · 1 comment · Fixed by #1552
Closed
2 tasks done

Move satori/go.uuid to google/uuid #1543

PushkarJ opened this issue Jan 24, 2022 · 1 comment · Fixed by #1552
Labels
kind/bug PR/Issue related to a bug needs-triage Indicates an issue or PR needs to be triaged

Comments

@PushkarJ
Copy link
Contributor

PushkarJ commented Jan 24, 2022

Bug description
github.com/satori/go.uuid has the following vulnerability.

✗ High severity vulnerability found in github.com/satori/go.uuid
  Description: Insecure Randomness
  Info: https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
  Introduced through: github.com/satori/[email protected]
  From: github.com/satori/[email protected]

However, this library is no longer maintained satori/go.uuid#115

Affected product area (please put an X in all that apply)

  • Security
  • Test and Release

Expected behavior
We are not using any unmaintained dependencies

Steps to reproduce the bug

  1. Clone repo
  2. Download snyk
  3. Run snyk test . inside repo directory

Version (include the SHA if the version is not obvious)

All versions (?)

Environment where the bug was observed (cloud, OS, etc)
N/A

Relevant Debug Output (Logs, manifests, etc)

Solution

After input from #1544 switching to google/uuid makes most sense

@PushkarJ PushkarJ added kind/bug PR/Issue related to a bug needs-triage Indicates an issue or PR needs to be triaged labels Jan 24, 2022
@github-actions
Copy link

Hey @PushkarJ! Thanks for opening your first issue. We appreciate your contribution and welcome you to our community! We are glad to have you here and to have your input on Tanzu Framework.

@PushkarJ PushkarJ changed the title Move satori/go.uuid to fork gofrs/uuid Move satori/go.uuid to google/uuid Jan 26, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
kind/bug PR/Issue related to a bug needs-triage Indicates an issue or PR needs to be triaged
Projects
None yet
1 participant