chore(deps): bump security-flagged dependencies (clears 21 Dependabot alerts) - #176
Open
blsmth wants to merge 1 commit into
Open
chore(deps): bump security-flagged dependencies (clears 21 Dependabot alerts)#176blsmth wants to merge 1 commit into
blsmth wants to merge 1 commit into
Conversation
Clears all 21 open Dependabot alerts by raising the minimum versions of aws-sdk-go-v2 (cloudwatchlogs, s3, eventstream), cli/cli/v2, go-jose/v4, and golang.org/x/crypto. cli/cli/v2 >= 2.93.0 requires Go 1.26 as its module floor, so go.mod and the pinned CI go-version are bumped to 1.26 to match; no other call sites needed changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears all 21 open Dependabot alerts (7 critical, 4 high, 9 moderate, 1 low) on
main.Version bumps
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogsgithub.com/aws/aws-sdk-go-v2/service/s3github.com/cli/cli/v2github.com/go-jose/go-jose/v4golang.org/x/crypto(indirect)github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream(indirect)go mod tidyalso pulled forward relatedaws-sdk-go-v2core/internal modules and a handful ofcli/cli/v2transitive deps; no majors were bumped.Notable side effect: Go 1.26 floor
cli/cli/v2>= v2.93.0 declaresgo 1.26.0as its module minimum, sogo getraised this repo'sgo.moddirective from 1.25.4 to 1.26.0. Updated the pinnedgo-versionin all.github/workflows/*.yml(databases, functional_tests, go_tests, goreleaser, nightly) from"1.25"to"1.26"to match. No other call sites needed changes — build and vet are clean against the newcli/cli/v2.x/crypto reachability note
go mod why golang.org/x/cryptoreports "main module does not need package golang.org/x/crypto" both before and after this bump — it's a transitive dep of nothing the CLI actually imports. The SSH-related CVEs behind the 7 critical/2 high/4 medium alerts are almost certainly not reachable from this binary. Bumped anyway to clear the alerts; actual risk was low.Supersedes #110
This replaces the stale Dependabot PR #110, which only bumps
x/cryptoto v0.45.0 — already below the v0.52.0 floor needed to clear the alerts. #110 should be closed once this merges (not closing it myself).Test plan
make fmt— no diffgo build ./...— cleango vet ./...— cleanmake test— all packages passmake lint— same 57 pre-existing issues (50 errcheck, 7 staticcheck) present onmainbefore this change; left untouched as out of scope