sec(deps): update go-chi/chi to v5 #2563
Conversation
|
Please sign the dco |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2563 +/- ##
===========================================
- Coverage 66.46% 25.04% -41.42%
===========================================
Files 92 189 +97
Lines 9258 24424 +15166
===========================================
- Hits 6153 6117 -36
- Misses 2359 17544 +15185
- Partials 746 763 +17
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
see GO-2025-3770 see GHSA-vrw8-fxc6-2r93 Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
|
@cpanato done! |
|
thanks @cpanato! is there a timeline on the next release? |
I looked at the CVE and while yes, we imported the package referenced, we do not use the code path that contains the vulnerability. I'm not sure there is a huge rush to push out a new release here, unless I'm missing something? |
|
@bobcallaway my understanding it's that not a rush either. Only downside is scanners marking it as possibly vulnerable (e.g. rekor is imported by cosign, which is imported by goreleaser, which is how I got here 😂) |
|
@caarlos0 that makes sense (and thanks for goreleaser - we love it!) we have a couple other changes we'd like to get in soon and should cut another release in the next couple weeks. |
|
cool, I'll keep an eye out for it. thanks for cosign & co, I love it :) |
GoReleaser itself is not affected by this, but govulncheck keeps complaining. I upgrade go-chi in rekor in sigstore/rekor#2563, but they haven't released it yet. This updates to rekor@main. Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
GoReleaser itself is not affected by this, but govulncheck keeps complaining. I upgrade go-chi in rekor in sigstore/rekor#2563, but they haven't released it yet. This updates to rekor@main. Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
Summary
There's a vulnerability in go-chi v4, and the only fix is to update to v5.
Seemed like a low lift, so I did it.
see https://pkg.go.dev/vuln/GO-2025-3770
see GHSA-vrw8-fxc6-2r93
Release Note
NONE
Documentation