Skip to content

Commit cef8cd2

Browse files
committed
chore(deps): update go-jose to fix GHSA-78h2-9frx-2jm8
Update go-jose v3 and v4 to patch security vulnerability in JWE and JWS handling. Signed-off-by: Akshay Pant <akpant@redhat.com>
1 parent 9fee580 commit cef8cd2

17 files changed

Lines changed: 316 additions & 230 deletions

File tree

go.mod

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,8 @@ require (
5555
github.com/cloudevents/sdk-go/sql/v2 v2.0.0-20240712172937-3ce6b2f1f011 // indirect
5656
github.com/coreos/go-oidc/v3 v3.14.1 // indirect
5757
github.com/fxamacker/cbor/v2 v2.8.0 // indirect
58-
github.com/go-jose/go-jose/v3 v3.0.4 // indirect
59-
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
58+
github.com/go-jose/go-jose/v3 v3.0.5 // indirect
59+
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
6060
github.com/google/gofuzz v1.2.0 // indirect
6161
github.com/rickb777/plural v1.4.3 // indirect
6262
github.com/robfig/cron/v3 v3.0.1 // indirect
@@ -147,7 +147,6 @@ require (
147147
)
148148

149149
replace (
150-
github.com/go-jose/go-jose/v4 => github.com/go-jose/go-jose/v4 v4.0.5
151150
k8s.io/api => k8s.io/api v0.32.4
152151
k8s.io/apimachinery => k8s.io/apimachinery v0.32.4
153152
sigs.k8s.io/gateway-api => sigs.k8s.io/gateway-api v1.0.0

go.sum

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -136,10 +136,10 @@ github.com/go-fed/httpsig v1.1.1-0.20201223112313-55836744818e/go.mod h1:RCMrTZv
136136
github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
137137
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
138138
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
139-
github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
140-
github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
141-
github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
142-
github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
139+
github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
140+
github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
141+
github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
142+
github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
143143
github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
144144
github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
145145
github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=

vendor/github.com/go-jose/go-jose/v3/asymmetric.go

Lines changed: 9 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

vendor/github.com/go-jose/go-jose/v3/cipher/key_wrap.go

Lines changed: 9 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

vendor/github.com/go-jose/go-jose/v3/symmetric.go

Lines changed: 18 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

vendor/github.com/go-jose/go-jose/v4/CHANGELOG.md

Lines changed: 0 additions & 96 deletions
This file was deleted.

vendor/github.com/go-jose/go-jose/v4/README.md

Lines changed: 39 additions & 37 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

vendor/github.com/go-jose/go-jose/v4/asymmetric.go

Lines changed: 9 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)