Sebastiaan van Stijn e6d91d843f vendor: github.com/golang/protobuf v1.5.4 ...

commit 10c7f03b3b updated google.golang.org/protobuf
to v1.33.0, which addresses CVE-2024-24786, however a follow-up post on the
Golang security list issued a warning that the v1.33.0 update introduced a
breaking change, causing compatibility with github.com/golang/protobuf to be
broken;

> A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown
> option is set (as well as when unmarshaling into any message which contains a
> google.protobuf.Any). There is no UnmarshalUnknown option.
>
> In addition, version 1.33.0 of google.golang.org/protobuf inadvertently
> introduced an incompatibility with the older github.com/golang/protobuf
> module. (https://github.com/golang/protobuf/issues/1596) Users of the older
> module should update to github.com/golang/protobuf@v1.5.4.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 45e425ccce)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

2024-03-20 10:25:31 +01:00

..

groupcache

Go mod vendor

2020-12-01 01:41:25 +08:00

protobuf

vendor: github.com/golang/protobuf v1.5.4

2024-03-20 10:25:31 +01:00