[release-v0.37.8] chore(deps): update go-jose to fix GHSA-78h2-9frx-2jm8#2717
Conversation
Update go-jose v3 and v4 to patch security vulnerability in JWE and JWS handling. Signed-off-by: Akshay Pant <akpant@redhat.com>
theakshaypant
changed the title
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the go-jose dependency to versions v3.0.5 and v4.1.4 and removes a replace directive that previously pinned v4 to version v4.0.5. Feedback was provided to ensure that the current version addresses security vulnerabilities and to investigate potential false positives in scanner alerts before considering a version pin, in accordance with security guidelines.
There was a problem hiding this comment.
Code Review
This pull request updates the go-jose library dependencies, upgrading github.com/go-jose/go-jose/v3 to v3.0.5 and github.com/go-jose/go-jose/v4 to v4.1.4. It also removes a version replacement directive for the v4 library in go.mod. I have no feedback to provide.
|
Merging the PR as the CI failure is expected. |
theakshaypant
merged commit cef8cd2
into
tektoncd:release-v0.37.8
2 participants
📝 Description of the Change
Update go-jose v3 and v4 to patch security vulnerability in JWE and JWS handling.
🔗 Linked GitHub Issue
N/A
🧪 Testing Strategy
🤖 AI Assistance
AI assistance can be used for various tasks, such as code generation,
documentation, or testing.
Please indicate whether you have used AI assistance
for this PR and provide details if applicable.
Important
Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.
If the majority of the code in this PR was generated by an AI, please add a
Co-authored-bytrailer to your commit message.For example:
Co-authored-by: Claude noreply@anthropic.com
✅ Submitter Checklist
fix:,feat:) matches the "Type of Change" I selected above.make testandmake lintlocally to check for and fix anyissues. For an efficient workflow, I have considered installing
pre-commit and running
pre-commit installtoautomate these checks.