Repository navigation
Conversation
Clears all 17 govulncheck module findings. x/net v0.60.0 raises the go.mod go line to 1.26. Nine standard-library findings remain and need the Go 1.27.2 toolchain.
Addendum — rebased onto master after #11Rebased onto
Advisories cleared, measured on the rebased branchBaseline was the published Reachable before: 10 (9 in x/net, 1 in jose2go). Reachable after: 0. Cleared because the code called them:
Also cleared, though govulncheck reported them as not called from our code: Still present, unreachable and with no upstream fix: GO-2022-0635 and Note on the earlier figures in this body: those were measured on go1.27.1 and Evidence on the rebased commit
One thing for oversightThe commit message still ends with "x/net v0.60.0 raises the go.mod go line to |
9b63e95 to
db5e363
Compare
Closes #22 · Upstream: Versent#1472 (x/net), Versent#1490 (x/crypto), Versent#1488 (jose2go)
Classification
type: uplift · nature: security · severity: S2 · provider: core
Change
Dependency bumps only, from
go getplusgo mod tidy. There are noreplacedirectives andgo mod verifyis clean.golang.org/x/netgithub.com/dvsekhvalnov/jose2gogithub.com/Azure/go-ntlmsspgolang.org/x/cryptogo.modafter tidygolang.org/x/sys/x/term/x/textVulnerabilities cleared (govulncheck v1.9.0)
Before: 20 reachable findings (17 in modules, 9 in the standard library, with 5 advisories counted in both). After: 0 reachable. Three findings remain that govulncheck says the code never calls: go-jose/v3 v3.0.4 (GO-2026-4945, fixed in v3.0.5) and two aws-sdk-go advisories with no fix (GO-2022-0635, GO-2022-0646). They are out of scope for this record.
Go standard-library findings (9)
GO-2026-6603, -6605, -6607, -6608, -6610, -6611, -6612, -6613 and -6617 are in
net/http,net/http/internal/http2,net/textprotoandcrypto/tls, and are fixed in Go 1.27.2. No module bump clears them; only the toolchain does.go.modon master already requiresgo 1.27.3, so any build of this branch uses a patched toolchain, and govulncheck run under go1.27.3 reports none of them. Anyone building with an older local toolchain andGOTOOLCHAIN=localwill be refused by thegoline rather than silently getting a vulnerable build.Release notes
go.modalready says on master. This PR does not change the floor. x/net v0.60.0 on its own needs only Go 1.26, so this PR adds no further constraint. The operator has accepted a floor of 1.26 or higher.Overlap with #11 (go-ntlmssp v0.1.1, record #7)
Both PRs bump
github.com/Azure/go-ntlmsspto v0.1.1. The target version is the same, so thego.modline will be identical, butgo.sumwill conflict textually whichever merges second. Suggested order: merge #11 first, since it carries the NTLM regression and handshake tests and the basic-fallback release note. Then rebase this branch and rungo mod tidy, which leaves a diff limited to x/net, jose2go and the x/ packages. The go-ntlmssp behaviour change (basic fallback off by default) is documented and tested in #11, not here.Shibboleth
Sprintffixpkg/provider/shibboleth/shibboleth.gocalledfmt.Sprintf(shibbolethHost + postAction)with a non-constant format string. Under agoline of 1.24 or later,go vet(and sogo test) rejects it, and it would also mangle any%in the post-action URL. It is now plain concatenation. That fix is already on master (25923f8, "build: uplift Go to 1.27.3"), so this PR contains no source changes. It is listed here because the uplift depends on it: without it, the package fails to build under test.Evidence (toolchain go1.27.3)
govulncheck ./...: 0 reachable vulnerabilities, standard library included.go mod tidy;go mod verify: all modules verified; noreplacedirectives.go test ./...: passes, exceptpkg/provider/browser(TestValidate, TestInvalidBrowserType, TestInvalidBrowserExecutablePath, TestAutoFill), which fails the same way on master. The Playwright 1.47.2 driver download returns 404; this is unrelated to this change.golangci-lintv2.14.0run ./...: 0 issues.GOOS=windows GOARCH=amd64,GOOS=darwin GOARCH=arm64andGOOS=linux GOARCH=arm64builds of./cmd/saml2aws: ok.make -C test/e2e unit,make -C test/e2e e2e, e2e-aws (oversight runs these).Regression test
None added. This is a pure version uplift. The specific risk (jose2go's deflate limit, x/net's HTTP/2 and HTML parsing) sits inside the libraries, and their own fixes are tested upstream. The existing provider tests cover our HTML parsing through x/net, and they pass. The e2e harness covers the keyring/jose2go path.