chore(deps): bump the gomod group across 1 directory with 15 updates - #731
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the gomod group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/in-toto/in-toto-golang](https://github.com/in-toto/in-toto-golang) | `0.9.0` | `0.11.0` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.22.0` | `1.23.2` | | [github.com/yannh/kubeconform](https://github.com/yannh/kubeconform) | `0.7.0` | `0.8.0` | | [go.uber.org/zap](https://github.com/uber-go/zap) | `1.27.0` | `1.28.0` | | [github.com/prometheus/procfs](https://github.com/prometheus/procfs) | `0.17.0` | `0.20.1` | Updates `github.com/in-toto/in-toto-golang` from 0.9.0 to 0.11.0 - [Release notes](https://github.com/in-toto/in-toto-golang/releases) - [Changelog](https://github.com/in-toto/in-toto-golang/blob/master/CHANGELOG.md) - [Commits](in-toto/in-toto-golang@v0.9.0...v0.11.0) Updates `github.com/prometheus/client_golang` from 1.22.0 to 1.23.2 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.22.0...v1.23.2) Updates `github.com/spf13/cobra` from 1.9.1 to 1.10.2 - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](spf13/cobra@v1.9.1...v1.10.2) Updates `github.com/yannh/kubeconform` from 0.7.0 to 0.8.0 - [Release notes](https://github.com/yannh/kubeconform/releases) - [Commits](yannh/kubeconform@v0.7.0...v0.8.0) Updates `go.uber.org/zap` from 1.27.0 to 1.28.0 - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.27.0...v1.28.0) Updates `github.com/prometheus/common` from 0.65.0 to 0.66.1 - [Release notes](https://github.com/prometheus/common/releases) - [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md) - [Commits](prometheus/common@v0.65.0...v0.66.1) Updates `github.com/prometheus/procfs` from 0.17.0 to 0.20.1 - [Release notes](https://github.com/prometheus/procfs/releases) - [Commits](prometheus/procfs@v0.17.0...v0.20.1) Updates `github.com/secure-systems-lab/go-securesystemslib` from 0.9.0 to 0.10.0 - [Release notes](https://github.com/secure-systems-lab/go-securesystemslib/releases) - [Commits](secure-systems-lab/go-securesystemslib@v0.9.0...v0.10.0) Updates `github.com/spf13/pflag` from 1.0.7 to 1.0.10 - [Release notes](https://github.com/spf13/pflag/releases) - [Commits](spf13/pflag@v1.0.7...v1.0.10) Updates `go.yaml.in/yaml/v2` from 2.4.2 to 2.4.4 - [Commits](yaml/go-yaml@v2.4.2...v2.4.4) Updates `golang.org/x/crypto` from 0.40.0 to 0.46.0 - [Commits](golang/crypto@v0.40.0...v0.46.0) Updates `golang.org/x/sys` from 0.34.0 to 0.41.0 - [Commits](golang/sys@v0.34.0...v0.41.0) Updates `golang.org/x/text` from 0.27.0 to 0.37.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.27.0...v0.37.0) Updates `google.golang.org/protobuf` from 1.36.6 to 1.36.11 Updates `sigs.k8s.io/yaml` from 1.5.0 to 1.6.0 - [Release notes](https://github.com/kubernetes-sigs/yaml/releases) - [Changelog](https://github.com/kubernetes-sigs/yaml/blob/master/RELEASE.md) - [Commits](kubernetes-sigs/yaml@v1.5.0...v1.6.0) --- updated-dependencies: - dependency-name: github.com/in-toto/in-toto-golang dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/prometheus/client_golang dependency-version: 1.23.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/spf13/cobra dependency-version: 1.10.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/yannh/kubeconform dependency-version: 0.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: go.uber.org/zap dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/prometheus/common dependency-version: 0.66.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/prometheus/procfs dependency-version: 0.20.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/secure-systems-lab/go-securesystemslib dependency-version: 0.10.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: gomod - dependency-name: github.com/spf13/pflag dependency-version: 1.0.10 dependency-type: indirect update-type: version-update:semver-patch dependency-group: gomod - dependency-name: go.yaml.in/yaml/v2 dependency-version: 2.4.4 dependency-type: indirect update-type: version-update:semver-patch dependency-group: gomod - dependency-name: golang.org/x/crypto dependency-version: 0.46.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: gomod - dependency-name: golang.org/x/sys dependency-version: 0.41.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: gomod - dependency-name: golang.org/x/text dependency-version: 0.37.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: gomod - dependency-name: google.golang.org/protobuf dependency-version: 1.36.11 dependency-type: indirect update-type: version-update:semver-patch dependency-group: gomod - dependency-name: sigs.k8s.io/yaml dependency-version: 1.6.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Kusari Analysis Results:Caution Flagged Issues Detected While the code analysis found zero security issues across all scanned files, the dependency analysis identified critical vulnerabilities that we strongly recommend addressing before merging. The PR upgrades golang.org/x/crypto to v0.46.0, but this version still carries 13 active security advisories including authentication bypasses (CVE-2026-39828, CVE-2026-42508, CVE-2026-46595), denial-of-service via memory leaks (CVE-2026-39827), server deadlock (CVE-2026-39830), RSA/DSA DoS (CVE-2026-39829), infinite loop (CVE-2026-39834), panics (CVE-2026-46597, CVE-2026-46598, CVE-2026-39835), and key constraint bypasses (CVE-2026-39831, CVE-2026-39832, CVE-2026-39833). A fully remediated version (v0.52.0) is available and should be targeted instead. Additionally, golang.org/x/sys v0.41.0 retains CVE-2026-39824 (integer overflow in NewNTUnicodeString on Windows), which is fixed in v0.45.0. The clean code analysis does not mitigate these dependency-level risks, as the two analyses are independent. Action items: (1) Run 'go get golang.org/x/crypto@v0.52.0' to resolve all 13 crypto advisories. (2) Run 'go get golang.org/x/sys@v0.45.0' to resolve the integer overflow CVE. These steps will significantly reduce the attack surface before merging. Note View full detailed analysis result for more information on the output and the checks that were run. Required Dependency Mitigations
Found this helpful? Give it a 👍 or 👎 reaction! |
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the gomod group with 5 updates in the / directory:
0.9.00.11.01.22.01.23.20.7.00.8.01.27.01.28.00.17.00.20.1Updates
github.com/in-toto/in-toto-golangfrom 0.9.0 to 0.11.0Release notes
Sourced from github.com/in-toto/in-toto-golang's releases.
... (truncated)
Commits
36d782fMerge pull request #462 from in-toto/fix-negation-character4a09e3bmatch: Replace ^ with ! for negation in character classesc3302e8Merge pull request #459 from in-toto/dependabot/go_modules/github.com/go-jose...016e87echore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.45b9df76Merge pull request #457 from in-toto/dependabot/go_modules/google.golang.org/...595b3fechore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3e396d24Merge pull request #452 from in-toto/dependabot/github_actions/all-502588e1ca142b779Merge pull request #453 from in-toto/dependabot/go_modules/all-d8ef5820aaf741bccchore(deps): bump the all group with 2 updatesc374dc9chore(deps): bump the all group across 1 directory with 2 updatesUpdates
github.com/prometheus/client_golangfrom 1.22.0 to 1.23.2Release notes
Sourced from github.com/prometheus/client_golang's releases.
... (truncated)
Changelog
Sourced from github.com/prometheus/client_golang's changelog.
Commits
8179a56Cut v1.23.2 (#1870)4142b59Merge pull request #1869 from prometheus/arve/upgrade-common4ff40f0Cut v1.23.1 (#1867)989b029Upgrade to prometheus/common v0.66 (#1866)e4b2208Cut v1.23.0 (#1848)d9492afcut v1.23.0-rc.1 (#1842)aeae8a0Cut v1.23.0-rc.0 (#1837)b157309Update common Prometheus files (#1832)a704e28build(deps): bump the github-actions group with 3 updates (#1826)c774311Fix errNotImplemented reference (#1835)Updates
github.com/spf13/cobrafrom 1.9.1 to 1.10.2Release notes
Sourced from github.com/spf13/cobra's releases.
... (truncated)
Commits
88b30abchore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 (#2336)346d408fix: actions/setup-go v6 (#2337)fc81d20refactor: change minUsagePadding from var to const (#2325)117698arefactor: replace several vars with consts (#2328)e2dd29dAdd documentation for repeated flags functionality (#2316)0629892Fix linter (#2327)7da941cchore: Bump pflag to v1.0.9 (#2305)51d6751Bump pflag to 1.0.8 (#2303)3f3b818Update README.md with new logodcaf42eAdd Periscope to the list of projects using Cobra (#2299)Updates
github.com/yannh/kubeconformfrom 0.7.0 to 0.8.0Release notes
Sourced from github.com/yannh/kubeconform's releases.
Commits
02374e5Update README (#360)1f6792cSmall fixes, better sanitization (#359)e5c533bfix: update duration validation to use strfmt package (#348)ab97ec7Update deps, make sure we use vendored dependencies (#358)b83bf79Openapi2jsonschema-go (#357)8e634e1fix: avoid panic when a schema document decodes to null (#356)d412494Read resources from multiple workers (#354)e608924Fix typo (#339)c7f8490fix: Github -> GitHub (#340)Updates
go.uber.org/zapfrom 1.27.0 to 1.28.0Release notes
Sourced from go.uber.org/zap's releases.
Changelog
Sourced from go.uber.org/zap's changelog.
Commits
5b81b37release v1.28.0 (#1547)0ab0d5azapcore: Add PreWriteHook for transforming entries before write (#1534)d278c59[chore] CI: test on Go 1.26 (#1535)16fb16bchore(dep): replace archived gopkg.in/yaml.v3 with officially maintained go.y...7b755a3release 1.27.1 (#1521)d6b395bUpdate lazy logger not to materialize unless it's being written to (#1519)4b9cea0ci: Test with Go 1.24, Go 1.25 (#1508)7c80d7bFix race condition in WithLazy implementation (#1426) (#1511)07077a6Prevent zap.Object from panicing on nils (#1501)a6afd05Fix lint check name (#1502)Updates
github.com/prometheus/commonfrom 0.65.0 to 0.66.1Release notes
Sourced from github.com/prometheus/common's releases.
... (truncated)
Changelog
Sourced from github.com/prometheus/common's changelog.
... (truncated)
Commits
8975ddeRevert "Use go.uber.org/atomic instead of sync/atomic (#825)" (#838)08d7f66Move to supported version of yaml parser (#834)80e275eRevert "Use github.com/grafana/regexp instead of regexp" (#835)4c2f9e7Merge pull request #832 from roidelapluie/retracte120453Retract v1.20.32b1487cMerge pull request #827 from prometheus/dependabot/go_modules/github.com/stre...db38951Merge pull request #829 from prometheus/dependabot/go_modules/golang.org/x/ne...9e19a90build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1a1ba2a7build(deps): bump golang.org/x/net from 0.42.0 to 0.43.0c7a031cMerge pull request #830 from prometheus/dependabot/go_modules/google.golang.o...Updates
github.com/prometheus/procfsfrom 0.17.0 to 0.20.1Release notes
Sourced from github.com/prometheus/procfs's releases.