split wharf
Guys, im trying make PR (https://github.com/99designs/gqlgen/pull/2432) and nancy reject it for security reason in tests.
It say, that in go.mod present module with 1 known vulnerabilities.
But my PR is about 3 lines of code. I dnt change go.mod and anything else. in "master" i see same module.
How can i resolve this problem?
limpid berry
check this for log https://github.com/99designs/gqlgen/actions/runs/3504528184/jobs/5870561164
which explains why it failed
i think it wants you to update gomod deps to pass
not sure if the maintainer will like it if the stuff get changed in an unrelated commit
just ask a msg there about what they want you to do
split wharf
i know, why it failed and i write about it in start topic. In master gomod same module
But other PR like my succesfully passed this test, Without update gomod. And i dnt know why
proud mesa
@split wharf if you follow the links it point you to this vulnerability: https://pkg.go.dev/vuln/GO-2022-1059
@split wharf it is weird that the CI is complaining on your PR, I think it's just a random thing because it happen to check go.mod now, I think any PR openned now would fail
Anyway you could send a PR updating the golang.org/x/text/language module or do it in your pr
split wharf
In master go.mod with 1.16. If i update gomod with my 1.19 and up-to-date deps it may be bad idea
proud mesa
@split wharf I did not say to update to 1.19, just update the golang.org/x/test/language module
it's not part of go you can update it as-is
split wharf
only rewrite in go.mod this line "golang.org/x/text v0.3.7"?
proud mesa
only rewrite in go.mod this line "golang.org/x/text v0.3.7"?
not even that, just do go get golang.org/x/text@latest (and go mod tidy)
split wharf
"go: upgraded golang.org/x/text v0.3.7 => v0.4.0". Now i have do commit go.mod and send to PR?
proud mesa
"go: upgraded golang.org/x/text v0.3.7 => v0.4.0". Now i have do commit go.mod a...
you need to run go mod tidy and commit go.mod and go.sum
I see it upgraded the major version, so it may break the code. Anyway the CI will tell you if it's wrong
split wharf
okey. I understand. I will try it now
proud mesa
Just so you, if you see version 0.4 broke CI, you can open https://pkg.go.dev/golang.org/x/text press the version number, it will open https://pkg.go.dev/golang.org/x/text?tab=versions
You will see the vulnerabilities attached to the versions. And v0.3.8 exists, since it don't change the major version (second number since it's 0.x.x), this one should be more compatible
So if CI breaks, you should try v0.3.8
(to do that go get golang.org/x/[email protected])
split wharf
https://github.com/99designs/gqlgen/pull/2432 try 0.3.8 first
split wharf
".github/workflows/check-federation
shell: /usr/bin/bash -e {0}
go: github.com/99designs/[email protected] requires
golang.org/x/[email protected]: missing go.sum entry; to add it:
go mod download golang.org/x/text"
At now it fails in federation test.