chore(deps): rollup renovate dependency updates#288
Conversation
|
Caution Review failedPull request was closed or merged during review WalkthroughThis PR updates multiple Go module versions in Changes
Sequence Diagram(s)(omitted) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 66: The dependency entry for module github.com/docker/docker is pinned to
v28.5.2+incompatible which is vulnerable; update the version string for
github.com/docker/docker to v29.3.1 or a later patched release in the go.mod,
then run go mod tidy (and rerun your build/tests) to ensure the new version and
transitive changes are resolved; reference the module name
github.com/docker/docker in go.mod and ensure the version token is changed to
v29.3.1+incompatible (or later) before merging.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e17ace5d-e076-477b-8d7b-e6af5d12bfe5
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (5)
go.modinternal/github/token.gointernal/github/token_internal_test.gointernal/github/token_test.gointernal/testhelpers/mockservers.go
| github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect | ||
| github.com/distribution/reference v0.6.0 // indirect | ||
| github.com/docker/docker v28.5.1+incompatible // indirect | ||
| github.com/docker/docker v28.5.2+incompatible // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the first patched version of github.com/docker/docker for GHSA-pxq6-2prw-chj9 and GHSA-x744-4wpc-v9h2, and is v28.5.2 affected?
💡 Result:
The first patched version of github.com/docker/docker (Moby project) for both GHSA-pxq6-2prw-chj9 and GHSA-x744-4wpc-v9h2 is v29.3.1. Docker Engine v28.5.2 is affected by both vulnerabilities.
Citations:
- 1: GHSA-pxq6-2prw-chj9
- 2: https://osv.dev/vulnerability/GHSA-pxq6-2prw-chj9
- 3: https://osv.dev/vulnerability/GHSA-x744-4wpc-v9h2
- 4: https://docs.docker.com/engine/release-notes/29/
- 5: https://docs.docker.com/engine/release-notes/28/
- 6: https://docs.docker.com/engine/release-notes
Upgrade github.com/docker/docker to v29.3.1 or later before merge.
v28.5.2+incompatible is affected by two HIGH severity vulnerabilities (GHSA-pxq6-2prw-chj9, GHSA-x744-4wpc-v9h2) related to AuthZ and plugin validation. Upgrade to v29.3.1, the first patched version that remediates both issues.
🧰 Tools
🪛 OSV Scanner (2.3.5)
[HIGH] 66-66: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation
[HIGH] 66-66: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 66, The dependency entry for module github.com/docker/docker
is pinned to v28.5.2+incompatible which is vulnerable; update the version string
for github.com/docker/docker to v29.3.1 or a later patched release in the
go.mod, then run go mod tidy (and rerun your build/tests) to ensure the new
version and transitive changes are resolved; reference the module name
github.com/docker/docker in go.mod and ensure the version token is changed to
v29.3.1+incompatible (or later) before merging.
* chore(deps): update dependency golangci-lint to v2.11.4 * fix(lint): resolve golangci-lint v2.11.4 failures New and updated linter rules introduced failures: - noctx now flags httptest.NewRequest without context; replaced with NewRequestWithContext in audit and jwt tests. requestSetup gains t.Helper() and t.Context() as it now accepts *testing.T. - staticcheck SA5008 fires on unexported fields with json tags in fieldmapper_test.go; suppressed as intentional test fixtures. - gosec G101 fires on "test-github-token" in test helpers; suppressed as non-credential test data. - gosec G118 fires on loopCancel in refresh.go; suppressed as false positive: the cancel func is stored in the struct and called via Close(). * fix(lint): fix remaining noctx violations in handlers_test.go Three more httptest.NewRequest calls flagged by the updated noctx rule (v2.11.0 extended detection to httptest.NewRequest). Replaced with NewRequestWithContext using t.Context(). --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: James Telfer <792299+jamestelfer@users.noreply.github.com>
1 participant
Purpose
Batch dependency update to reduce PR noise and keep the dependency graph current.
Context
Rolls up 9 Renovate PRs into a single merge, skipping golangci-lint and tink updates which need separate handling.
Merged PRs
Skipped PRs
Summary by CodeRabbit
Chores
Tests