Skip to content

Commit adb71b4

Browse files
committed
fix(deps): update go-jose to fix GHSA-78h2-9frx-2jm8
Update go-jose v3 and v4 to patch security vulnerability in JWE and JWS handling. Signed-off-by: Akshay Pant <akpant@redhat.com>
1 parent 5f5514e commit adb71b4

17 files changed

Lines changed: 316 additions & 230 deletions

File tree

go.mod

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,8 @@ require (
5454
github.com/cloudevents/sdk-go/sql/v2 v2.16.2 // indirect
5555
github.com/coreos/go-oidc/v3 v3.17.0 // indirect
5656
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
57-
github.com/go-jose/go-jose/v3 v3.0.4 // indirect
58-
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
57+
github.com/go-jose/go-jose/v3 v3.0.5 // indirect
58+
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
5959
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
6060
github.com/go-openapi/swag/conv v0.25.4 // indirect
6161
github.com/go-openapi/swag/fileutils v0.25.4 // indirect
@@ -154,7 +154,6 @@ require (
154154
)
155155

156156
replace (
157-
github.com/go-jose/go-jose/v4 => github.com/go-jose/go-jose/v4 v4.0.5
158157
github.com/google/gnostic-models => github.com/google/gnostic-models v0.6.9
159158
k8s.io/api => k8s.io/api v0.32.8
160159
k8s.io/apimachinery => k8s.io/apimachinery v0.32.8

go.sum

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -140,10 +140,10 @@ github.com/go-fed/httpsig v1.1.1-0.20201223112313-55836744818e/go.mod h1:RCMrTZv
140140
github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
141141
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
142142
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
143-
github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
144-
github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
145-
github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
146-
github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
143+
github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
144+
github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
145+
github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
146+
github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
147147
github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
148148
github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
149149
github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=

vendor/github.com/go-jose/go-jose/v3/asymmetric.go

Lines changed: 9 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

vendor/github.com/go-jose/go-jose/v3/cipher/key_wrap.go

Lines changed: 9 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

vendor/github.com/go-jose/go-jose/v3/symmetric.go

Lines changed: 18 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

vendor/github.com/go-jose/go-jose/v4/CHANGELOG.md

Lines changed: 0 additions & 96 deletions
This file was deleted.

vendor/github.com/go-jose/go-jose/v4/README.md

Lines changed: 39 additions & 37 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

vendor/github.com/go-jose/go-jose/v4/asymmetric.go

Lines changed: 9 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)