fix(security): bump Go deps for 3 reachable vulnerabilities#20
Conversation
The "Go Vulnerability Scan" CI job has been failing on main for a while. It isn't flaky — govulncheck reports 3 vulnerabilities that it can trace to actual call sites in core, i.e. reachable, not merely present in the dependency graph: - GO-2026-5004 — SQL injection via placeholder confusion with dollar-quoted string literals in github.com/jackc/pgx/v5. Trace: store.PostgreSQLStore.GetMemoryTurns -> pgxpool.Pool.Query -> sanitize.SanitizeSQL (internal/store/postgres.go:741). v5.9.1 -> v5.9.2 - GO-2026-5158 — OpenTelemetry baggage parsing no longer caps raw header length. Trace: tracing.ExtractContext -> propagation.Extract -> baggage.Parse (internal/tracing/tracing.go:140). Reads straight from request headers, so the input is attacker-controlled. v1.43.0 -> v1.44.0, applied across the whole otel family so the API and SDK versions stay in lockstep. - GO-2026-5970 — infinite loop on invalid input in golang.org/x/text. Trace: store.NewPostgreSQLStore -> pgxpool.NewWithConfig -> norm.Form.* (internal/store/postgres.go:84). v0.35.0 -> v0.39.0 Each is now at exactly the version govulncheck names as "Fixed in". The other bumps (grpc, grpc-gateway, x/net, x/crypto, x/sys, x/sync, genproto) are transitive consequences of the otel upgrade resolved by `go mod tidy`. go.mod/go.sum only — no source changes. Verified with `go build ./...` and `go test ./... -race -count=1` (all packages pass). govulncheck itself can't run in this sandbox (vuln.go.dev is blocked at the network layer), so CI is the confirmation that the findings clear.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Warning Review limit reached
Next review available in: 33 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub. |
|
2 participants
What does this PR do?
The Go Vulnerability Scan CI job has been failing on
mainfor a while. It isn't flaky —govulncheckreports 3 vulnerabilities it can trace to actual call sites incore, i.e. reachable, not merely present in the dependency graph.store.PostgreSQLStore.GetMemoryTurns→pgxpool.Pool.Query→sanitize.SanitizeSQL(internal/store/postgres.go:741)jackc/pgx/v5v5.9.1 → v5.9.2tracing.ExtractContext→propagation.Extract→baggage.Parse(internal/tracing/tracing.go:140)go.opentelemetry.io/otelv1.43.0 → v1.44.0store.NewPostgreSQLStore→pgxpool.NewWithConfig→norm.Form.*(internal/store/postgres.go:84)golang.org/x/textv0.35.0 → v0.39.0The first two matter most because both sit on attacker-controlled input: one is the SQL layer, the other parses OTel baggage straight out of request headers.
Each dependency is now at exactly the version
govulnchecknames as "Fixed in". The OTel bump is applied across the whole family (otel,trace,sdk,metric, and the four exporters) so the API and SDK versions stay in lockstep. The remaining changes (grpc,grpc-gateway,x/net,x/crypto,x/sys,x/sync,genproto) are transitive consequences of that upgrade, resolved bygo mod tidy.go.mod/go.sumonly — no source changes.Related issue
Not a roadmap item — surfaced while diagnosing the persistently failing CI check on #19.
Checklist
go build ./...clean,go test ./... -race -count=1green across all 27 packagesGenerated by Claude Code