-
Notifications
You must be signed in to change notification settings - Fork 970
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bump github.com/stretchr/testify from 1.7.1 to 1.8.0 #720
Comments
Hi, do you have time to submit a PR 😄 |
I don't have a development environment set up for this project - filing an issue because we use it as a dependency. |
thanks for addressing this! looking forward to the release w/ the fix |
PTAL @atercattus |
Hello. As I see we still use the wrong yaml.v3 version:
And objx uses wrong yaml.v3 in the latest version. And the latest testify uses wrong objx. And as I see you know about this stretchr/objx#121 :) We need to update objx too to fix this vulnerability... |
1.7.1 has a vulnerable dependency yaml.v3 that's fixed in 1.8.0. Anyone using go-mysql who's running security tooling is getting warnings about the following:
Security bug: https://security.snyk.io/vuln/SNYK-GOLANG-GOPKGINYAMLV3-2952714
To resolve, you should be able to do:
go get github.com/stretchr/testify
go mod tidy
I don't see any breaking changes between the 1.7.1 and 1.8.0 versions
The text was updated successfully, but these errors were encountered: