show grpc cve comment

jfrog · Dec 4, 2023 · 2f6ceb1 · 2f6ceb1
1 parent 3b58e80
commit 2f6ceb1
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/go.mod b/go.mod
@@ -122,13 +122,15 @@ require (
 	golang.org/x/text v0.13.0 // indirect
 	golang.org/x/tools v0.14.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13 // indirect
-	google.golang.org/grpc v1.58.3 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
+// Should not be updated to v1.58.2 due to CVE-2023-44487
+require google.golang.org/grpc v1.58.3 // indirect
+
 // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go v1.8.9-0.20231130093251-25c79868c10c
 
 // replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 v2.31.1-0.20231130101652-2aaa8c0c51ec