Bump golang.org/x/net to address security concerns [CVE-2024-45338], [CVE-2024-45337]

[RainbowMango]

Task description:
Bump golang.org/x/net in go.mod to v0.34.0.
(Note: golang.org/x/[email protected] requires golang.org/x/[email protected])

Which will address two CVEs:

• CVE-2024-45338: Non-linear parsing of case-insensitive content in golang.org/x/net/html
  • We are not affected as we don't use the package golang.org/x/net/html.
  • References: analysis from Kubernetes community.
• CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
  • We are not affected as we don't use the package golang.org/x/crypto/ssh.
  • References: analysis from Kubernetes community

Solution:

Update the golang.org/x/net in go.mod to v0.34.0, like:

diff --git a/go.mod b/go.mod
index f7128c17c..c5787300c 100644
--- a/go.mod
+++ b/go.mod
@@ -27,7 +27,7 @@ require (
        github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64
        go.uber.org/mock v0.4.0
-       golang.org/x/net v0.28.0
+       golang.org/x/net v0.34.0
        golang.org/x/term v0.23.0
        golang.org/x/text v0.17.0
        golang.org/x/time v0.5.0

And then, run the command make update, commit all generated files.

Who can join or take the task:

The good first issue is intended for first-time contributors to get started on his/her contributor journey.

After a contributor has successfully completed 1-2 good first issue's,
they should be ready to move on to help wanted items, saving the remaining good first issue for other new contributors.

How to join or take the task:

Just reply on the issue with the message /assign in a separate line.

Then, the issue will be assigned to you.

How to ask for help:

If you need help or have questions, please feel free to ask on this issue.
The issue author or other members of the community will guide you through the contribution process.

[yaten2302]

/assign

[RainbowMango]

Thanks @yaten2302, Any update? Please let me know if you need any help.

[yaten2302]

Hey @RainbowMango , when I've run the command make update after changing to v0.34.0, but the file changes are as follows: (and in the end it's also showing 2 errors on running go mod vender)

[RainbowMango]

I've no clue about the Device or resource busy, but it seems the generated file was put in a nested directory.
I guess you can clone the karmada repo under your $GOPATH, that is $GOPATH/src/github.com/karmada-io/karmada, and try again.

[RainbowMango]

find your GOPATH by command: go env GOPATH, by the way.

[yaten2302]

This is my GOPATH

[yaten2302]

So, should I do - git clone $GOPATH/src/github.com/karmada-io/karmada?

[RainbowMango]

You can give it a try, remember to replace $GOPATH with the output of go env GOPATH