FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix(security): remediate CVE vulnerabilities by upbound-bot · Pull Request #25 · upbound/function-openai · GitHub

/ function-openai Public

fix(security): remediate CVE vulnerabilities - #25

Merged
ulucinar merged 3 commits into
release-0.3from
fix/cve-remediation-release-0.3-20260324-214628
Mar 25, 2026
ConversationCommits (3)ChecksFiles changed
Merged

fix(security): remediate CVE vulnerabilities#25
ulucinar merged 3 commits into
release-0.3from
fix/cve-remediation-release-0.3-20260324-214628

Conversation

upbound-bot commented Mar 24, 2026

Copy link
Copy Markdown

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA Severity Package Fixed Version
GHSA-p77j-4mvh-x3m3 Critical google.golang.org/grpc v1.79.3
CVE-2026-25679 High stdlib (Go) 1.25.8
GHSA-6g7g-w4f8-9c9x High github.com/buger/jsonparser v1.1.2
CVE-2026-27142 Medium stdlib (Go) 1.25.8
CVE-2026-27139 Low stdlib (Go) 1.25.8

Changes Made

  • Updated Go version from 1.24.13 to 1.25.8 in go.mod and toolchain directive
  • Updated google.golang.org/grpc from v1.71.1 to v1.79.3 in go.mod
  • Updated github.com/buger/jsonparser from v1.1.1 to v1.1.2 in go.mod
  • Ran go mod tidy to update dependencies
  • Updated GO_VERSION to '1.25.8' in .github/workflows/ci.yml
  • Migrated .golangci.yml from v1 to v2 syntax for golangci-lint v1.64.2 compatibility

References

Verification

  • Rescanned with cve-scan skill after fixes
  • All listed vulnerabilities resolved

fix(security): remediate CVE vulnerabilities
5822d45 
- Update Go version to 1.25.8 (fixes CVE-2026-25679, CVE-2026-27142, CVE-2026-27139)
- Update google.golang.org/grpc to v1.79.3 (fixes GHSA-p77j-4mvh-x3m3)
- Update github.com/buger/jsonparser to v1.1.2 (fixes GHSA-6g7g-w4f8-9c9x)
- Migrate .golangci.yml to v2 syntax for golangci-lint compatibility
- Update CI workflow to use Go 1.25.8

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>

upbound-bot commented Mar 24, 2026

Copy link
Copy Markdown
Author

Build Failure Analysis

Check: lint
Status: Failed
Analyzed: 2026-03-24T21:47:40Z

Summary

The lint check failed due to a Go version mismatch between golangci-lint and the project's target Go version.

Root Cause

The golangci-lint binary (v1.64.2) was built with Go 1.24, but the project now uses Go 1.25.8 after the CVE remediation. golangci-lint refuses to run when its build version is lower than the target Go version to avoid potential compatibility issues.

Error Details

Error: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.8)

Recommendation

Update GOLANGCI_VERSION in .github/workflows/ci.yml to a version built with Go 1.25 or later. The latest version (v1.64.3 or newer) should support Go 1.25.8.

This analysis was generated by the build-failure-analyze skill.

fix(ci): update golangci-lint to v2.11.4 for Go 1.25.8 compatibility
b833c85 
The previous version (v1.64.2) was built with Go 1.24 and cannot lint
code targeting Go 1.25.8.

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>

upbound-bot commented Mar 24, 2026

Copy link
Copy Markdown
Author

Build Failure Analysis

Check: lint
Status: Failed
Analyzed: 2026-03-24T22:19:57Z

Summary

The lint check failed due to incompatibility between golangci-lint v2.11.4 and golangci-lint-action v6.

Root Cause

The CI workflow uses golangci-lint-action@v6, which does not support golangci-lint v2.x versions. The error explicitly states: "golangci-lint v2 is not supported by golangci-lint-action v6, you must update to golangci-lint-action v7."

Error Details

Error: invalid version string 'v2.11.4', golangci-lint v2 is not supported by golangci-lint-action v6, you must update to golangci-lint-action v7.

Recommendation

Upgrade golangci/golangci-lint-action from v6 to v7 in .github/workflows/ci.yml to support golangci-lint v2.x versions required for Go 1.25.8 compatibility.

This analysis was generated by the build-failure-analyze skill.

fix(ci): upgrade golangci-lint-action to v7
8a28bc6 
Golangci-lint-action v6 does not support golangci-lint v2.x versions.
Upgrade to v7 to use golangci-lint v2.11.4 with Go 1.25.8.

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>
ulucinar reviewed Mar 25, 2026
View reviewed changes
Comment thread .golangci.yml
run:
timeout: 10m
timeout: 90m
concurrency: 1

ulucinar Mar 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

We would like to use a common configuration across the official package repositories...

ulucinar merged commit 88b13ab into release-0.3 Mar 25, 2026
5 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

ulucinar ulucinar approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

Back | FazBrowse Home | New Git URL