chore: Update unsupported v2 of go-jose to supported v4#4439
Merged
Conversation
Signed-off-by: MacRae Linton <macrael@confidentsecurity.com>
Signed-off-by: MacRae Linton <macrael@confidentsecurity.com>
ianlewis
approved these changes
Oct 6, 2025
| # Approved packages. | ||
| - "github.com/spf13/cobra" # For CLI | ||
| - "github.com/coreos/go-oidc" # For verifying OIDC tokens. | ||
| - "github.com/go-jose/go-jose/v4" # For testing OIDC tokens |
Member
There was a problem hiding this comment.
hmm. How was depguard allowing gopkg.in/square/go-jose.v2 before? 🤔
Contributor
Author
There was a problem hiding this comment.
my guess is it was an old line, never linted? but I really don't know
|
xref #408 |
|
@ianlewis looks like this PR is ready to go? Can you help with merging it? |
Member
|
@sgreene570 Yeah, looks fine. This won't show up on a proper tag until we do a tagged release, which is a bit complicated. Given that no one is really working on this much anymore it might be a while. I think you could import it from latest if you're ok doing that. |
Yup, this is just fine, thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
We're getting Dependabot warnings about using go-jose v2 in our repo b/c we import slsa-github-generator. This PR updates the import to use the supported v4 of the library and updates go mod. All go tests pass, it looks like go-jose is only used in one line of the tests for GitHub biz.
...
Testing Process
make go-testand everything was clean. This change only affected tests so that feels sufficient....
Checklist