fix the cve GHSA-v778-237x-gjrc

Signed-off-by: Batuhan Apaydin <[email protected]>
wolfi-dev · Dec 14, 2024 · 1041bf1 · 1041bf1
1 parent 7eabc2a
commit 1041bf1
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/opentelemetry-collector.yaml b/opentelemetry-collector.yaml
@@ -13,6 +13,7 @@ environment:
       - curl
       - go
       - openssf-compiler-options
+      - yq
 
 pipeline:
   - runs: |
@@ -44,6 +45,7 @@ pipeline:
   - runs: |
       set -x
       # Use the builder to compile opentelemetry-collector
+      yq eval '.replaces += ["golang.org/x/crypto => golang.org/x/crypto v0.31.0"]' builder-config.yaml -i
       ${{targets.destdir}}/usr/bin/ocb --config=builder-config.yaml
 
       install -Dm755 ./_build/otelcol "${{targets.destdir}}"/usr/bin/otelcol