dgraph-io / badger

Fast key-value DB in Go.

Home Page:https://dgraph.io/badger

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Vulnerability report

sourabh-shinde opened this issue · comments

There is a critical vulnerability in the dependencies with package go-etcd

This is caused by a transitive dependency from github.com/spf13/cobra v0.0.5
github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=

Here - https://github.com/dgraph-io/badger/blob/c903578894e469ebf580fafb3788fdf2a2086717/go.sum#LL9C1-L9C101

The request with this issue is to upgrade to the latest spf13/cobra version v1.7.0