DoDiODev opened a new pull request, #9054:
URL: https://github.com/apache/devlake/pull/9054
### Summary
Bumps six dependencies that carry known advisories. Touches `backend/go.mod`
and
`backend/go.sum` only — no source change was required.
| Module | From | To | CVEs |
|---|---|---|---|
| `golang.org/x/crypto` | v0.41.0 | v0.55.0 | 15 (7 CRITICAL) |
| `golang.org/x/net` | v0.43.0 | v0.58.0 | CVE-2026-25680 |
| `golang.org/x/oauth2` | v0.13.0 | v0.36.0 | CVE-2025-22868 |
| `github.com/golang-jwt/jwt/v5` | v5.0.0-rc.1 | v5.3.1 | CVE-2025-30204 |
| `github.com/sirupsen/logrus` | v1.9.0 | v1.10.0 | CVE-2025-65637 |
| `google.golang.org/protobuf` | v1.31.0 | v1.36.12 | CVE-2024-24786 |
`jwt/v5` was pinned to a **release candidate from March 2023** in a
security-sensitive position (GitHub App tokens, OIDC sessions).
### Reachability
`govulncheck ./...` in `backend/`:
| | reachable findings |
|---|---|
| before (`upstream/main`) | **30** |
| after this PR | **22** (remainder: `go-git` 8, `go-billy` 2, `circl` 2,
`go-jose/v3` 2 + stdlib) |
This PR removes the 6 reachable `x/crypto` findings, 1 in `x/net`, 1 in
`x/text`
(pulled up by MVS) and the `jwt/v5` one. The reachable `x/crypto` SSH
findings
come from `core/utils/io.go`, where archives are copied via
`github.com/viant/afs`, which registers an SSH/SCP backend — **not** from
gitextractor, which clones with the git CLI.
### Verification
- `go mod tidy` — clean, no further changes
- `go build ./server/... ./core/... ./helpers/... ./impls/...` — green
- unit tests of `server/…` (incl. `server/api/auth` JWT session handling),
`helpers/…` (incl. `oidchelper`), `core/…`, `plugins/github`,
`plugins/teambition` — green
- `govulncheck ./...` before/after as above
### Notes
MVS also pulls up `x/sys`, `x/term`, `x/sync`, `x/mod`, `x/text` and
`x/tools`.
### CI
Verified on a fork run of the same workflows before opening this PR:
[8/8 green](https://github.com/DoDiODev/devlake/actions/runs/32008009642)
(lint, unit-test, e2e MySQL, migration-script-lint, config-ui, license
header,
grafana dashboards, builder image).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
