CGA-7r53-fp7v-mm22

The github.com/distribution/distribution/v3 dependency at version v3.0.0-20221208165359-362910506bc2 contains a vulnerability that is fixed in v3.1.0. This is a transitive dependency brought in via github.com/devfile/library/v2/pkg/devfile (used by the gitlab-org/ruby/gems/devfile-gem that ships with GitLab) and cannot be directly overridden. Resolution requires:

• Upstream github.com/devfile/library to migrate its imports from github.com/distribution/distribution/v3/reference to github.com/distribution/reference (the reference subpackage was extracted into its own module starting in distribution/v3 v3.1.0). Until that migration lands, go mod tidy cannot resolve the vulnerable transitive to v3.1.0+ because the upstream library still imports a path that no longer exists in the fixed version. Current blocker: upstream devfile/library has not migrated to github.com/distribution/reference. There is no v3 release that contains both the security fix and the /reference subpackage. See upstream project: https://github.com/devfile/library