Skip to content

chore(deps): bump the security-updates group with 22 updates #155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

chore(deps): bump the security-updates group with 22 updates #155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
141 changes: 69 additions & 72 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,67 +1,68 @@
module github.com/kubeservice-stack/common

go 1.26
go 1.26.0

require (
github.com/BurntSushi/toml v1.5.0
github.com/BurntSushi/toml v1.6.0
github.com/asjdf/gorm-cache v1.3.0
github.com/caarlos0/env/v10 v10.0.0
github.com/efficientgo/core v1.0.0-rc.3
github.com/gin-gonic/gin v1.11.0
github.com/gin-gonic/gin v1.12.0
github.com/glebarez/sqlite v1.11.0
github.com/go-kit/log v0.2.1
github.com/go-sql-driver/mysql v1.9.2
github.com/go-sql-driver/mysql v1.10.0
github.com/mattn/go-isatty v0.0.22
github.com/mcuadros/go-version v0.0.0-20190830083331-035f6764e8d2
github.com/opentracing/opentracing-go v1.2.0
github.com/prometheus/client_golang v1.22.0
github.com/redis/go-redis/v9 v9.19.0
github.com/prometheus/client_golang v1.23.2
github.com/redis/go-redis/v9 v9.20.0
github.com/stretchr/testify v1.11.1
github.com/uber-go/tally v3.5.0+incompatible
github.com/vmihailenco/msgpack/v5 v5.4.1
go.etcd.io/etcd/api/v3 v3.5.21
go.etcd.io/etcd/client/v3 v3.5.21
go.etcd.io/etcd/server/v3 v3.5.21
go.opentelemetry.io/contrib/propagators/autoprop v0.63.0
go.opentelemetry.io/contrib/samplers/jaegerremote v0.37.0
go.opentelemetry.io/otel v1.43.0
go.opentelemetry.io/otel/bridge/opentracing v1.36.0
go.opentelemetry.io/otel/exporters/jaeger v1.16.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0
go.opentelemetry.io/otel/sdk v1.43.0
go.opentelemetry.io/otel/trace v1.43.0
go.etcd.io/etcd/api/v3 v3.6.12
go.etcd.io/etcd/client/v3 v3.6.12
go.etcd.io/etcd/server/v3 v3.6.12
go.opentelemetry.io/contrib/propagators/autoprop v0.69.0
go.opentelemetry.io/contrib/samplers/jaegerremote v0.37.1
go.opentelemetry.io/otel v1.44.0
go.opentelemetry.io/otel/bridge/opentracing v1.44.0
go.opentelemetry.io/otel/exporters/jaeger v1.17.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0
go.opentelemetry.io/otel/sdk v1.44.0
go.opentelemetry.io/otel/trace v1.44.0
go.uber.org/atomic v1.11.0
go.uber.org/zap v1.27.0
golang.org/x/sys v0.42.0
google.golang.org/grpc v1.80.0
go.uber.org/zap v1.28.0
golang.org/x/sys v0.45.0
google.golang.org/grpc v1.81.1
gopkg.in/natefinch/lumberjack.v2 v2.2.1
gopkg.in/yaml.v2 v2.4.0
gorm.io/driver/mysql v1.6.0
gorm.io/driver/postgres v1.6.0
gorm.io/gorm v1.30.0
gorm.io/gorm v1.31.1
gorm.io/plugin/opentelemetry v0.1.16
k8s.io/client-go v0.34.1
k8s.io/client-go v0.36.1
)

require (
filippo.io/edwards25519 v1.1.0 // indirect
filippo.io/edwards25519 v1.2.0 // indirect
github.com/ClickHouse/ch-go v0.61.5 // indirect
github.com/ClickHouse/clickhouse-go/v2 v2.30.0 // indirect
github.com/andybalholm/brotli v1.1.1 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bluele/gcache v0.0.2 // indirect
github.com/bytedance/sonic v1.14.0 // indirect
github.com/bytedance/sonic/loader v0.3.0 // indirect
github.com/bytedance/gopkg v0.1.3 // indirect
github.com/bytedance/sonic v1.15.0 // indirect
github.com/bytedance/sonic/loader v0.5.0 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/cloudwego/base64x v0.1.6 // indirect
github.com/coreos/go-semver v0.3.0 // indirect
github.com/coreos/go-semver v0.3.1 // indirect
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/gabriel-vasile/mimetype v1.4.8 // indirect
github.com/gabriel-vasile/mimetype v1.4.12 // indirect
github.com/gin-contrib/sse v1.1.0 // indirect
github.com/glebarez/go-sqlite v1.21.2 // indirect
github.com/go-faster/city v1.0.1 // indirect
Expand All @@ -71,33 +72,32 @@ require (
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-playground/locales v0.14.1 // indirect
github.com/go-playground/universal-translator v0.18.1 // indirect
github.com/go-playground/validator/v10 v10.27.0 // indirect
github.com/goccy/go-json v0.10.3 // indirect
github.com/goccy/go-yaml v1.18.0 // indirect
github.com/go-playground/validator/v10 v10.30.1 // indirect
github.com/goccy/go-json v0.10.5 // indirect
github.com/goccy/go-yaml v1.19.2 // indirect
github.com/gogo/googleapis v1.4.1 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/btree v1.1.3 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/hashicorp/go-version v1.6.0 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
github.com/jackc/pgx/v5 v5.6.0 // indirect

@coderabbitai coderabbitai Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Find parent dependency and check for pgx/v5 updates

# Find which direct dependency requires pgx/v5
go mod graph | grep 'jackc/pgx/v5'

# Check for available newer versions
go list -m -versions github.com/jackc/pgx/v5

# Check security advisories
gh api graphql -f query='
{
  securityVulnerabilities(first: 10, ecosystem: GO, package: "github.com/jackc/pgx") {
    nodes {
      advisory {
        summary
        severity
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Repository: kubeservice-stack/common

Length of output: 2303

🌐 Web query:

What is the latest patched version of github.com/jackc/pgx/v5 that fixes CVE-2026-33815 and GHSA-j88v-2chj-qfwx?

💡 Result:

The latest patched version of github.com/jackc/pgx/v5 that addresses the specified vulnerabilities is v5.9.2 or later [1][2]. Regarding the specific identifiers: - CVE-2026-33815 (also tracked as GHSA-xgrm-4fwx-7qm8 and GO-2026-4771) is a memory-safety vulnerability fixed in version 5.9.0 [3][4][5]. - GHSA-j88v-2chj-qfwx (associated with CVE-2026-41889) is an SQL injection vulnerability fixed in version 5.9.2 [2][6]. Since version 5.9.2 includes fixes for both issues (and subsequent versions like v5.10.0 contain all prior security patches), upgrading to v5.9.2 or the latest available version (v5.10.0 as of June 2026) is recommended [7][1][2].

Citations:

🌐 Web query:

GHSA-9jj7-4m8r-rfcm github.com/jackc/pgx/v5 affected versions fixed version

💡 Result:

The vulnerability GHSA-9jj7-4m8r-rfcm (also identified as CVE-2026-33816) is a critical memory-safety vulnerability affecting the github.com/jackc/pgx/v5 package [1][2]. Affected versions include all versions before 5.9.0 [1][2]. The fixed version is 5.9.0 or later [1][2].

Citations:

🌐 Web query:

CVE-2026-33815 github.com/jackc/pgx/v5 fixed in which version affected range

💡 Result:

CVE-2026-33815 is a memory-safety vulnerability in the github.com/jackc/pgx/v5/pgproto3 package [1][2]. It was caused by improper validation of an array index in the Bind.Decode() function, which could allow an attacker to trigger unexpected memory access or a client-side panic by sending specially crafted input with a negative parameter length [2]. The affected range is all versions of github.com/jackc/pgx/v5 prior to v5.9.0 [3][4]. The vulnerability was fixed in version 5.9.0 [1][2].

Citations:

🌐 Web query:

CVE-2026-33816 github.com/jackc/pgx/v5 fixed in which version affected range

💡 Result:

CVE-2026-33816 is a critical memory-safety vulnerability (specifically a use-after-free flaw) identified in the github.com/jackc/pgx/v5 Go library [1][2][3]. This vulnerability has been fixed in version 5.9.0 [1][4][3]. Any version of github.com/jackc/pgx/v5 released prior to 5.9.0 is affected [1][3]. Users are advised to upgrade to version 5.9.0 or later to mitigate the risk [2].

Citations:

🌐 Web query:

GHSA-j88v-2chj-qfwx github.com/jackc/pgx/v5 fixed in which version affected range

💡 Result:

The vulnerability GHSA-j88v-2chj-qfwx, also tracked as CVE-2026-41889, is a SQL injection issue affecting the github.com/jackc/pgx/v5 Go package [1][2]. The affected range is all versions prior to 5.9.2 (< 5.9.2) [1][3]. The issue was fixed in version 5.9.2 [1][4]. The vulnerability can occur specifically when the non-default simple protocol (pgx.QueryExecModeSimpleProtocol) is used in conjunction with a dollar-quoted string literal that contains content which would be interpreted as a query placeholder outside of that string literal, and the value of that placeholder is controllable by an attacker [1][5].

Citations:

CRITICAL: Upgrade transitive github.com/jackc/pgx/v5 from v5.6.0 to >= v5.9.2.

go.mod has github.com/jackc/pgx/v5 v5.6.0 // indirect (pulled by gorm.io/driver/postgres v1.6.0). v5.6.0 is affected by:

Update gorm.io/driver/postgres (or the dependency that pins pgx) so pgx/v5 resolves to v5.9.2 or later (v5.10.0 is available).

🧰 Tools
🪛 OSV Scanner (2.3.8)

[CRITICAL] 95-95: github.com/jackc/pgx/v5 5.6.0: CVE-2026-33815 in github.com/jackc/pgx

(GO-2026-4771)

[CRITICAL] 95-95: github.com/jackc/pgx/v5 5.6.0: CVE-2026-33816 in github.com/jackc/pgx

(GO-2026-4772)

[CRITICAL] 95-95: github.com/jackc/pgx/v5 5.6.0: Memory-safety vulnerability in github.com/jackc/pgx/v5.

(GHSA-9jj7-4m8r-rfcm)

[CRITICAL] 95-95: github.com/jackc/pgx/v5 5.6.0: pgx: SQL Injection via placeholder confusion with dollar quoted string literals

(GHSA-j88v-2chj-qfwx)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 95, go.mod currently resolves github.com/jackc/pgx/v5 to
v5.6.0 via gorm.io/driver/postgres; update dependencies so pgx/v5 resolves to >=
v5.9.2 (prefer v5.10.0) by either bumping gorm.io/driver/postgres to a version
that pulls pgx v5.9.2+ or adding an explicit require for github.com/jackc/pgx/v5
v5.9.2 (or v5.10.0) in go.mod and then run go get github.com/jackc/pgx/v5@v5.9.2
(or `@v5.10.0`) and go mod tidy to ensure transitive resolution, verify with go
list -m all that github.com/jackc/pgx/v5 now resolves to v5.9.2+.

github.com/jackc/puddle/v2 v2.2.2 // indirect
github.com/jaegertracing/jaeger-idl v0.6.0 // indirect
github.com/jaegertracing/jaeger-idl v0.9.0 // indirect
github.com/jinzhu/inflection v1.0.0 // indirect
github.com/jinzhu/now v1.1.5 // indirect
github.com/jonboulle/clockwork v0.2.2 // indirect
github.com/jonboulle/clockwork v0.5.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/karlseguin/ccache/v3 v3.0.3 // indirect
github.com/klauspost/compress v1.18.0 // indirect
Expand All @@ -115,58 +115,55 @@ require (
github.com/pierrec/lz4/v4 v4.1.21 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.62.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/quic-go/qpack v0.5.1 // indirect
github.com/quic-go/quic-go v0.54.0 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.66.1 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/quic-go/qpack v0.6.0 // indirect
github.com/quic-go/quic-go v0.59.0 // indirect
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
github.com/segmentio/asm v1.2.0 // indirect
github.com/shopspring/decimal v1.4.0 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/soheilhy/cmux v0.1.5 // indirect
github.com/spf13/pflag v1.0.6 // indirect
github.com/spf13/pflag v1.0.10 // indirect
github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
github.com/twmb/murmur3 v1.1.6 // indirect
github.com/ugorji/go/codec v1.3.0 // indirect
github.com/ugorji/go/codec v1.3.1 // indirect
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
go.etcd.io/bbolt v1.3.11 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.5.21 // indirect
go.etcd.io/etcd/client/v2 v2.305.21 // indirect
go.etcd.io/etcd/pkg/v3 v3.5.21 // indirect
go.etcd.io/etcd/raft/v3 v3.5.21 // indirect
go.etcd.io/bbolt v1.4.3 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.12 // indirect
go.etcd.io/etcd/pkg/v3 v3.6.12 // indirect
go.etcd.io/raft/v3 v3.6.0 // indirect
go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
go.opentelemetry.io/contrib/propagators/aws v1.38.0 // indirect
go.opentelemetry.io/contrib/propagators/b3 v1.38.0 // indirect
go.opentelemetry.io/contrib/propagators/jaeger v1.38.0 // indirect
go.opentelemetry.io/contrib/propagators/ot v1.38.0 // indirect
go.opentelemetry.io/otel/metric v1.43.0 // indirect
go.opentelemetry.io/proto/otlp v1.7.1 // indirect
go.uber.org/mock v0.5.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0 // indirect
go.opentelemetry.io/contrib/propagators/aws v1.44.0 // indirect
go.opentelemetry.io/contrib/propagators/b3 v1.44.0 // indirect
go.opentelemetry.io/contrib/propagators/jaeger v1.44.0 // indirect
go.opentelemetry.io/contrib/propagators/ot v1.44.0 // indirect
go.opentelemetry.io/otel/metric v1.44.0 // indirect
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.yaml.in/yaml/v2 v2.4.2 // indirect
golang.org/x/arch v0.20.0 // indirect
golang.org/x/crypto v0.49.0 // indirect
golang.org/x/mod v0.33.0 // indirect
golang.org/x/net v0.52.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
golang.org/x/arch v0.22.0 // indirect
golang.org/x/crypto v0.51.0 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/sync v0.20.0 // indirect
golang.org/x/text v0.35.0 // indirect
golang.org/x/time v0.9.0 // indirect
golang.org/x/tools v0.42.0 // indirect
google.golang.org/genproto v0.0.0-20240823204242-4ba0660f739c // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
google.golang.org/protobuf v1.36.11 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/time v0.14.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
gorm.io/driver/clickhouse v0.7.0 // indirect
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
modernc.org/libc v1.22.5 // indirect
modernc.org/mathutil v1.5.0 // indirect
modernc.org/memory v1.5.0 // indirect
modernc.org/sqlite v1.23.1 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)

Expand Down
Loading
Loading