Closed
Description
It seems that nginxinc/nginx-kubernetes-gateway
at now indirectly depends on newer version of golang.org/x/text
and golang.org/x/net
which has fixed related vulnerability.
So, it makes no sense to keep according replace directive in go.mod. Should them be dropped?
golang.org/x/net v0.5.0 // indirect
golang.org/x/text v0.6.0 // indirect
replace (
// temporary fix for CVE-2022-27664
golang.org/x/net v0.0.0-20220722155237-a158d28d115b => golang.org/x/net v0.0.0-20220906165146-f3363e06e74c
//temporary fix for CVE-2022-27664
golang.org/x/text v0.3.7 => golang.org/x/text v0.3.8
)
Aha! Link: https://nginx.aha.io/features/NKG-48
Metadata
Metadata
Assignees
Labels
No labels