CVE reported for golang protobuf, crypto, and net (CVE-2024-24786, CVE-2024-45337, CVE-2023-45288, CVE-2024-45338)

[kernelcore8]

Multiple CVE have been reported for these dependencies:

• CVE-2024-24786 (medium) : golang protobuf (1.32.0) (fixed in 1.33.0) (see PR Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 #82)
• CVE-2024-45337 (high) : golang/x/crypto (0.19.0) (fixed in 0.31.0) (see PR Bump golang.org/x/crypto from 0.17.0 to 0.31.0 #80)
• CVE-2023-45288 (medium) : golang/x/net (0.20.0) (fixed in 0.23.0)
• CVE-2024-45338 (medium) : golang/x/net (0.20.0) (fixed in 0.23.0)

Affected version: code-marketplace 2.3.0

• code-marketplace/go.mod

  Line 44 in f8791bb

  google.golang.org/protobuf v1.32.0 // indirect

• code-marketplace/go.mod

  Line 36 in f8791bb

  golang.org/x/crypto v0.19.0 // indirect

• code-marketplace/go.mod

  Line 37 in f8791bb

  golang.org/x/net v0.20.0 // indirect

Is it possible to update these dependencies and build a new version of code-marketplace?

[code-asher]

Thanks for the heads up, I will get these merged and a new release today.