fix: [NPM] [CVEs] Update go.mod to Fix NPM golang.org/x/net CVE-2025-22870 #3518
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* removed all logs from npm dataplane (except error/warning logs) * removed all logs from npm controller (except error/warning logs) * restored logs that are ununused by current npm (v2) * removed test files * resolved comments * keep log related to reconciling chain placement when the chain is not in the right place * added bootup logs back * Removed two more noisy logs * Add loglevel config option when printing application insight logs * Updated all non-error/warning logs to commented out and with a vap TODO * fixed typo * small typo fix * updated configmap with loglevel * updated default value * added a default value for loglevel * fixed typo in json * removed comma * changed loglevel to info in configmap * add a short sleep in TestNetPolInBackgroundSkipAddAfterRemove * test remove dataplane changes to see if race condition fixes * Revert "test remove dataplane changes to see if race condition fixes" This reverts commit 08697eb. * test * Revert "test" This reverts commit 449c2af. * test * update dataplane to test if changes are flagged in race * added stop channels to unit tests to avoid race condtiions * add non noisy logs back * increased time * revert time change after RunPeriodicTasks * test with 1000 seconds * 5000 milliseconds * tweaked the delay * update to 1500 for defer * increased to 1500 * increase to 2000 * removed kubernetes
Contributor
Author
|
/azp run Azure Container Networking PR |
Contributor
Author
|
/azp run NPM Conformance Tests |
Contributor
Author
|
/azp run NPM Scale Test |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
Azure Pipelines could not run because the pipeline triggers exclude this branch/path. |
1 similar comment
|
Azure Pipelines could not run because the pipeline triggers exclude this branch/path. |
huntergregory
previously approved these changes
Mar 20, 2025
Contributor
Author
|
Manually ran scale and conformance pipelines since there is no (direct) change to npm directory scale: https://msazure.visualstudio.com/One/_build/results?buildId=118731448&view=results |
huntergregory
previously approved these changes
Mar 21, 2025
huntergregory
approved these changes
Mar 21, 2025
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Reason for Change:
Updates the go.mod
golang.org/x/netfromv0.35.0tov0.36.0to resolveCVE-2025-22870present inv0.35.0Issue Fixed:
Trivy scan of NPM on current v1.5 release (v1.5.44):
Trivy scan of NPM after go.mod golang.org/x/net
v0.36.0update:Requirements:
Notes: