DoDiODev opened a new pull request, #9278: URL: https://github.com/apache/devlake/pull/9278
### Summary `backend/go.mod` pins `github.com/go-jose/go-jose/v4` at v4.1.4. That version is affected by [GHSA-mgcc-cww5-fp2q](https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q) (CVE-2026-116587, severity high). A JWK with an RSA key can trigger a denial of service while it is being parsed. DevLake uses go-jose indirectly, through `coreos/go-oidc/v3`: ```text github.com/apache/devlake/helpers/oidchelper github.com/coreos/go-oidc/v3/oidc github.com/go-jose/go-jose/v4 ``` `helpers/oidchelper` (used by `server/api/auth`) fetches the OIDC provider's JWKS and verifies ID tokens against it. That is the code path the advisory describes. This PR bumps go-jose to v4.1.6 (`go get github.com/go-jose/go-jose/[email protected] && go mod tidy`). Only `backend/go.mod` and `backend/go.sum` change. The regular Dependabot version updates do not pick this up. The weekly `go-minor-patch` group (#9268) only contains direct dependencies, and go-jose is `// indirect`. ### Does this close any open issues? N/A ### Screenshots N/A ### Other Information - Behaviour change in v4.1.6: JWK parsing now rejects RSA keys whose modulus is larger than 4096 bits (configurable via `jose.MaxRSAModulusBits`). Common OIDC providers sign with 2048- or 3072-bit keys, so I did not change the default. - Verified locally: `go build ./...`, `make mock`, `scripts/unit-test-go.sh` pass (including `helpers/oidchelper` and `server/api/auth`). - Fork CI on the same change (golangci-lint, unit-test, e2e on MySQL, config-ui, license header, Grafana check; 14/14 jobs green): https://github.com/DoDiODev/devlake/actions/runs/40847595592 - No overlap with open PRs; #9268 touches a different line in `go.mod`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
