Repository navigation
Update github.com/gin-gonic/gin #318
Description
Hi!
Could you please update the https://github.com/gin-gonic/gin. Github Dependabot send alerts to projects uses your nhooyr/websocket project because you use the https://github.com/gin-gonic/gin v1.6.3, but they need Patched version: 1.7.0.
See the message:
CVE-2020-28483
high severity
Vulnerable versions: < 1.7.0
Patched version: 1.7.0
This affects all versions of package https://github.com/gin-gonic/gin under 1.7.0. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.
I have use your https://github.com/nhooyr/websocket project in my https://github.com/kirill-scherba/teowebrtc project for make webrtc signaling client/server and this Github Dependabot alert is placed in my project page now :-)
I think you need just execute go get -u and publish new tag!
Thanks.
Best regards,
Kirill Scherba.
Activity
kirill-scherba commentedon Oct 2, 2021
P.S. There is PR which fix this issue: #310
Update all modules
Merge pull request #1 from kirill-scherba:kirill-scherba/issue318
Module name updated
oderwat commentedon Nov 16, 2021
I actuallly wonder how this is "single dependency" with all the other modules needed :)
Update all modules
Module name updated
prochac commentedon Feb 4, 2023
I'm also for the dependency removal, then struggle with its upgrades.
It bothers both gin users or no.
AFAIK it's used only for integration test.
The same is about
github.com/gobwas/wsandgithub.com/gorilla/websocketthat are listed as dependency while they not.nhooyr commentedon Feb 25, 2023
All dependencies other than klauspost/compress are for tests alone. And dev has no dependencies whatsoever though I don't suggest running it in production yet.
nhooyr commentedon Mar 5, 2023
I'll remove gin soon and move the third party tests into a different module so they don't show up and cause all this confusion.
nhooyr commentedon Mar 6, 2023
Closing in favour of #297