This is an automated email from the ASF dual-hosted git repository.
klesh pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/devlake.git
The following commit(s) were added to refs/heads/main by this push:
new 26ecd53b0 fix(deps): bump go-jose/v4 to 4.1.6 for GHSA-mgcc-cww5-fp2q
(#9278)
26ecd53b0 is described below
commit 26ecd53b06a2298eab230b230e9b3c21ee0ae120
Author: Dirk <[email protected]>
AuthorDate: Fri Oct 30 08:05:28 2026 +0100
fix(deps): bump go-jose/v4 to 4.1.6 for GHSA-mgcc-cww5-fp2q (#9278)
go-jose v4.1.4 is affected by CVE-2026-116587 (GHSA-mgcc-cww5-fp2q,
severity high): parsing a JWK that contains an oversized RSA key can be
used for denial of service. DevLake pulls go-jose in indirectly through
coreos/go-oidc/v3, which helpers/oidchelper uses to verify OIDC tokens
against the provider's JWKS.
v4.1.6 caps the accepted RSA modulus at 4096 bits during JWK parsing.
Signed-off-by: DoDiODev <[email protected]>
---
backend/go.mod | 2 +-
backend/go.sum | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/backend/go.mod b/backend/go.mod
index 338b70f60..4dcbf0538 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -85,7 +85,7 @@ require (
github.com/go-errors/errors v1.4.2 // indirect
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
github.com/go-git/go-billy/v5 v5.9.2 // indirect
- github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+ github.com/go-jose/go-jose/v4 v4.1.6 // indirect
github.com/go-openapi/jsonpointer v0.19.5 // indirect
github.com/go-openapi/jsonreference v0.19.6 // indirect
github.com/go-openapi/spec v0.20.4 // indirect
diff --git a/backend/go.sum b/backend/go.sum
index 14a262a56..94ca50f9a 100644
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -112,8 +112,8 @@ github.com/go-git/go-git-fixtures/v4
v4.3.2-0.20231010084843-55a94097c399 h1:eMj
github.com/go-git/go-git-fixtures/v4
v4.3.2-0.20231010084843-55a94097c399/go.mod
h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
github.com/go-git/go-git/v5 v5.19.3
h1:qHttbZ+Am7wEjdTpR1XMQ4rl42FK9SIXzZ4o9x7s6M4=
github.com/go-git/go-git/v5 v5.19.3/go.mod
h1:Ye4C8dVigkqrv9UsB4NMdSLV4yAIkLiIhW61gcOyhl4=
-github.com/go-jose/go-jose/v4 v4.1.4
h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod
h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.6
h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
+github.com/go-jose/go-jose/v4 v4.1.6/go.mod
h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
github.com/go-openapi/jsonpointer v0.19.3/go.mod
h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
github.com/go-openapi/jsonpointer v0.19.5
h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
github.com/go-openapi/jsonpointer v0.19.5/go.mod
h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
