Skip to content

docs: document plural-cli security remediation ownership and fixed pins #761

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
plural-copilot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: document plural-cli security remediation ownership and fixed pins #761

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,4 +27,16 @@ Detailed instructions can be found at https://docs.plural.sh/deployments/cli-qui

## Reaching Out

If you have any issues with your plural installations, or just want to show us some love, feel free to drop into our discord [here](https://discord.gg/bEBAMXV64s)
If you have any issues with your plural installations, or just want to show us some love, feel free to drop into our discord [here](https://discord.gg/bEBAMXV64s)
## Security remediation note

This repository already pins the Go toolchain and Go module versions requested for the console-mapped remediation:

- Go toolchain: `1.26.4` in `go.mod`
- Container build/test images: `golang:1.26.4` in `Dockerfile`, `test.Dockerfile`, and hack scripts
- `github.com/go-git/go-git/v5`: `v5.19.1`
- `github.com/containerd/containerd`: `v1.7.32`
- `github.com/aws/aws-sdk-go-v2/service/s3`: `v1.97.3`
- `github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`: `v1.7.8`

No steampipe postgres plugin sources or build definitions were found in this repository, so the affected `steampipe_postgres_{aws,azure,gcp}.so` artifacts appear to be imported from elsewhere. This repo's nearest remediation path is to keep the embedded CLI build inputs pinned to the fixed Go/toolchain and module versions above and document that the plugin artifacts must be rebuilt in their owning source repository or image pipeline.
Loading