mirror/helm-dashboard
1
0
Fork 0
mirror of https://github.com/komodorio/helm-dashboard.git synced 2026-09-03 01:45:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

build(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.2 (#735)

Browse Source 
Closes two high-severity Dependabot advisories with no automated PR:
- tar extraction: hardlink entry with relative Linkname escapes extract
  dir via process CWD resolution
- blob upload vulnerable to credential forwarding via unvalidated
  Location header

Pulled in via helm.sh/helm/v3 and marked indirect; Go module resolution
allows raising it above what the parent requires. golang.org/x/sync moves
0.20.0 -> 0.22.0 as a requirement of oras-go 2.6.2.

Verified with go build, go vet and go test ./pkg/...

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Andrey Pokhilko
2026-08-08 12:34:23 +01:00
committed by GitHub
co-authored by Claude Opus 5
parent 254c99b900
commit 3ef80b5779
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+2 -2
View File
@@ -136,7 +136,7 @@ require (
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/sync v0.20.0 // indirect
golang.org/x/sync v0.22.0 // indirect
golang.org/x/sys v0.45.0 // indirect
golang.org/x/term v0.43.0 // indirect
golang.org/x/text v0.37.0 // indirect
@@ -155,7 +155,7 @@ require (
k8s.io/component-helpers v0.35.1 // indirect
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
oras.land/oras-go/v2 v2.6.0 // indirect
oras.land/oras-go/v2 v2.6.2 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/kustomize/api v0.20.1 // indirect
sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect