chore(deps): update module github.com/rs/cors to v1.11.0 [security]

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/rs/cors	v1.10.1 → v1.11.0

GitHub Vulnerability Alerts

CVE-2025-47908

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

---

Denial of service via malicious preflight requests in github.com/rs/cors

CVE-2025-47908 / GHSA-mh55-gqvf-xfwm / GO-2024-2883

More information

Details

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Severity

Unknown

References

• https://github.com/rs/cors/pull/171
• https://github.com/rs/cors/issues/170

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Denial of service via malicious preflight requests in github.com/rs/cors

CVE-2025-47908 / GHSA-mh55-gqvf-xfwm / GO-2024-2883

More information

Details

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Severity

Moderate

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-47908
• https://github.com/rs/cors/issues/170
• https://github.com/rs/cors/pull/171
• https://github.com/rs/cors/commit/4c32059b2756926619f6bf70281b91be7b5dddb2
• https://github.com/rs/cors
• https://pkg.go.dev/vuln/GO-2024-2883

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rs/cors (github.com/rs/cors)

v1.11.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

---

Note

Low Risk
Dependency-only bump of github.com/rs/cors with no code changes; behavior impact is limited to CORS middleware internals, though it targets a DoS-related security fix.

Overview
Updates the indirect Go dependency github.com/rs/cors from v1.10.1 to v1.11.0 in go.mod/go.sum (security-related release).

No application code changes; only module metadata and checksums are updated.

^{Written by Cursor Bugbot for commit d0088a0. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

CORS wildcard credentials behavior may change

Medium Severity

Updating github.com/rs/cors to v1.11.0 can change runtime CORS behavior, notably for configurations combining AllowedOrigins: ["*"] with AllowCredentials: true. If the service relied on the prior “reflect any Origin” behavior, cross-origin requests may start failing because the expected Access-Control-Allow-Origin header is no longer emitted.

Additional Locations (1)

• go.sum#L1190-L1202

 

[cursor]

Bugbot Autofix determined this is a false positive.

The alertmanager uses cors.Default() which sets AllowCredentials to false, so the v1.11.0 behavior change for wildcard origins with credentials enabled does not apply to this codebase.