Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade tonic to v0.12.3 to fix security vulnerability #680

Merged
merged 1 commit into from
Oct 30, 2024

Conversation

boxofrad
Copy link
Contributor

What was changed

cd temporalio/bridge && cargo update tonic --precise 0.12.3

Why?

Pulls in fix for CVE-2024-47609, which has started showing up in our container scanner reports.

@boxofrad boxofrad requested a review from a team as a code owner October 30, 2024 15:33
@CLAassistant
Copy link

CLAassistant commented Oct 30, 2024

CLA assistant check
All committers have signed the CLA.

@cretz
Copy link
Member

cretz commented Oct 30, 2024

Thanks! Will merge if/when CI passes (there are a couple of other things in 0.12.2+ that were fixed wrt TLS using system certs too IIUC). EDIT: There are some flakes in CI currently, but nothing specific to your change, we should be able to merge shortly.

@cretz cretz merged commit 0b327b0 into temporalio:main Oct 30, 2024
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants