msb-public
/
helm
mirror of https://github.com/helm/helm
1
0
Code Issues Projects Releases Wiki Activity

[dev-v3] bump golang.org/x/text@v0.39.0 for GO-2026-5970

Browse Source 
Related to https://github.com/helm/helm/pull/32310
however cherry-picking is not working well here
and for this patch release, this was fixed in v0.39.0 so not bumping to v0.40.0 here

fixed with:

```
go get golang.org/x/text@v0.39.0
go mod tidy
```

example actions fail:

```
  Vulnerability #2: GO-2026-5970
      Infinite loop on invalid input in golang.org/x/text
    More info: https://pkg.go.dev/vuln/GO-2026-5970
    Module: golang.org/x/text
      Found in: golang.org/x/text@v0.38.0
      Fixed in: golang.org/x/text@v0.39.0
      Example traces found:
  Error:       #1: pkg/repo/repotest/server.go:148:2: repotest.OCIServer.Run calls registry.Registry.ListenAndServe, which eventually calls norm.Form.Bytes
  Error:       #2: pkg/repo/repotest/server.go:148:2: repotest.OCIServer.Run calls registry.Registry.ListenAndServe, which eventually calls norm.Form.IsNormalString
  Error:       #3: cmd/helm/docs.go:89:61: helm.run calls cases.Caser.String, which eventually calls norm.Form.Properties
  Error:       #4: pkg/repo/repotest/server.go:148:2: repotest.OCIServer.Run calls registry.Registry.ListenAndServe, which eventually calls norm.Form.QuickSpan
  Error:       #5: pkg/repo/repotest/server.go:148:2: repotest.OCIServer.Run calls registry.Registry.ListenAndServe, which eventually calls norm.Form.String
```

Signed-off-by: Scott Rigby <scott@r6by.com>
pull/32537/head
Scott Rigby 2 months ago
parent a442b8cf64
commit 08c75bc359
No known key found for this signature in database
GPG Key ID: C7C6FBB5B91C1155
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File

4
go.mod
Unescape View File

@ -33,9 +33,9 @@ require (
github.com/spf13/cobra v1.10.2
github.com/spf13/pflag v1.0.10
github.com/stretchr/testify v1.11.1
golang.org/x/crypto v0.54.0
golang.org/x/crypto v0.53.0
golang.org/x/term v0.45.0
golang.org/x/text v0.40.0
golang.org/x/text v0.39.0
gopkg.in/yaml.v3 v3.0.1
k8s.io/api v0.36.3
k8s.io/apiextensions-apiserver v0.36.3

8
go.sum
Unescape View File

@ -388,8 +388,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@ -457,8 +457,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

Write Preview
Loading…
Cancel
Save