Bump Go dependencies and fix open code scanning alerts - #409
Merged
Merged
Conversation
Aggregates dependabot PRs google#397, google#398, google#399, google#400, google#401: - github.com/jackc/pgx/v5 v5.10.0 -> v5.11.0 - github.com/modelcontextprotocol/go-sdk v1.7.0 -> v1.8.0 - golang.org/x/net v0.58.0 -> v0.59.0 - golang.org/x/oauth2 v0.36.0 -> v0.37.0 - golang.org/x/time v0.15.0 -> v0.16.0 Also bumps the transitively pulled x/crypto, x/sync, x/sys, x/text, x/mod, x/tools and applies the same x/net and x/time versions to the cmd/nano-init module.
Fixes CodeQL alerts google#29-google#32 and google#23: - console: set HttpOnly/Secure/SameSite on the logout and OIDC state/verifier deletion cookies, matching the attributes of the cookies they clear. - sambox: apply filepath.Base to the interceptor filename before joining. isValidIdentifier already forbids path separators, so this is defense in depth (and a sanitizer CodeQL recognizes).
Fixes CodeQL alert google#22 (go/missing-jwt-signature-check). VerifyJWT uses ParseUnverified only to extract iss/aud and route to the right OIDC provider before the real signature verification, but it then returned the claims map from that unverified parse. Decode the claims from the signature-verified oidc.IDToken instead so callers can never observe claims that differ from what was actually signed.
Fixes the scorecard PinnedDependenciesID alerts that are worth fixing: - Pin every Dockerfile base image to its multi-arch index digest (production Dockerfile.*, tests/e2e/docker and development/examples) and extend the dependabot docker ecosystem to those directories, grouped, so the digests keep getting refreshed. - kind-mesh-e2e: pin kind to v0.33.0 and kubectl to v1.37.0 instead of @latest / stable.txt. - deploy-github-pages: pin the PostCSS toolchain npm packages. - gen-proto.sh: pin protoc-gen-go to the go.mod protobuf version. Left as-is deliberately: the curl|bash in scripts/startup-script.sh (scale-test VM bootstrap that intentionally installs the latest release) and pip/npm installs inside dev-example and e2e-fixture images, where hash-pinning adds churn without protecting anything that ships.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request focuses on security hardening and dependency updates across the repository. Key changes include pinning Docker base images to specific SHA256 digests, updating Go dependencies, securing console session and OIDC cookies with HttpOnly, Secure, and SameSite attributes, and ensuring OIDC JWT claims are decoded from the verified token. Additionally, path traversal defense-in-depth was added to the gateway. The review feedback correctly notes a violation of the repository style guide due to the lack of regression and negative tests for these security fixes, and provides a code suggestion to make the verified claims declaration more idiomatic.
zizmor's insufficient-cooldown audit (medium) fails the zizmor-output job for every update entry without a cooldown. A 7-day cooldown also gives upstream releases time to be yanked before we pick them up.
Review feedback on google#409: security fixes need a regression/negative test. - console: assert the logout deletion cookie carries HttpOnly/SameSite and a negative MaxAge (fails before the cookie hardening). - identity: forge a token by swapping the payload under a valid signature and assert VerifyJWT rejects it returning no claims. - identity: declare verifiedClaims idiomatically (var, nil map).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aggregates the open dependabot PRs and fixes the open code scanning alerts that are worth fixing, grouped into reviewable commits.
Dependency bumps (one commit)
Supersedes and closes #397, #398, #399, #400, #401:
github.com/jackc/pgx/v5v5.10.0 → v5.11.0github.com/modelcontextprotocol/go-sdkv1.7.0 → v1.8.0golang.org/x/netv0.58.0 → v0.59.0golang.org/x/oauth2v0.36.0 → v0.37.0golang.org/x/timev0.15.0 → v0.16.0The x/* bumps raise the
godirective to 1.26.0 (matches CI'sGO_VERSION: 1.26). The same x/net and x/time versions are applied to thecmd/nano-initmodule. Note: this needed theDirector→Rewritemigration from #407 (now merged) to pass staticcheck under go 1.26.Code scanning fixes
deploy.yaml;release.ymlwrite grants moved from workflow level to the goreleaser job.HttpOnly/Secure/SameSitematching the cookies they clear; the sambox interceptor filename getsfilepath.Baseas defense in depth (isValidIdentifieralready forbids separators).go/missing-jwt-signature-check):VerifyJWTkeeps usingParseUnverifiedonly to route iss/aud to the right provider, but now returns claims decoded from the signature-verifiedoidc.IDTokeninstead of the unverified pre-parse.tests/e2e/dockeranddevelopment/examples, grouped, to keep digests fresh); kind pinned to v0.33.0 and kubectl to v1.37.0 in kind-mesh-e2e; PostCSS npm packages pinned in deploy-github-pages;protoc-gen-gopinned to the go.mod protobuf version.Deliberately not fixed
curl | bashinscripts/startup-script.sh(alert 83): scale-test VM bootstrap that intentionally installs the latest release.pip/npminstalls inside dev-example and e2e-fixture images: hash-pinning adds churn without protecting anything that ships.Validation
make,make lint,make test(incl. integration and nano-init module) all pass locally after rebasing on refactor(node): migrate service proxy from Director to Rewrite #407.