Repository navigation
chore(deps): bump fiber, pgx and go-pkgz/auth to fixed versions - #1060
Merged
javi11 merged 1 commit intoNov 11, 2026
Merged
Conversation
Lowest versions that clear every published advisory for each module: - github.com/gofiber/fiber/v2 v2.52.9 -> v2.52.14 GO-2026-4543 / CVE-2026-25882 (route parameter overflow DoS, reachable via App.All and App.Get), plus GO-2026-4471 / CVE-2025-66630, GO-2026-5585 / CVE-2026-42554 and GO-2026-5887 / CVE-2026-45045. - github.com/jackc/pgx/v5 v5.8.0 -> v5.9.2 GO-2026-5004 / CVE-2026-41889 (placeholder confusion with dollar-quoted literals, reachable via sql.Tx.Commit), plus GO-2026-4771 / CVE-2026-33815 and GO-2026-4772 / CVE-2026-33816. - github.com/go-pkgz/auth/v2 v2.0.0 -> v2.1.2 GO-2026-5348 / CVE-2026-42560 (Patreon provider; altmount does not use that provider, but the module is flagged). The other go.mod changes are all forced by go-pkgz/auth v2.1.2 through minimal version selection: go get of fiber v2.52.14 or pgx v5.9.2 alone changes nothing else, while go get of auth v2.1.2 alone produces exactly this set (x/crypto, x/net, x/text, x/image, x/oauth2, klauspost/compress, golang-jwt, mongo-driver, bbolt and a few smaller ones). These are the minimum versions auth v2.1.2 and its own dependencies declare; nothing is raised past that. go mod tidy only drops the unused go-pkgz/repeater v1. No code changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps three direct dependencies that have published advisories, each to the lowest version that clears all of them. Trivy flagged these as CRITICAL in our image, and I re-checked against OSV and govulncheck on current main.
govulncheck on current main reports GO-2026-4543 as reachable through
App.All/App.Get, and GO-2026-5004 throughsql.Tx.Commiton the Postgres path. The auth advisory is about the Patreon provider, which altmount doesn't use, but the package is still flagged. After the bump, govulncheck no longer reports any of the three modules.The rest of the
go.moddiff is forced by go-pkgz/auth v2.1.2 through minimal version selection.go getof the fiber or pgx bump alone changes nothing else;go getof auth v2.1.2 alone produces exactly this set (x/crypto, x/net, x/text, x/image, x/oauth2, klauspost/compress, golang-jwt, mongo-driver, bbolt and a few smaller ones), each at the minimum version auth v2.1.2 or its dependencies declare.go mod tidyonly drops the now unused go-pkgz/repeater v1. There are no code changes.Tested with
go build ./..., thengo testandgo veton every package that imports these modules (internal/database,internal/webdav,internal/api,cmd/altmount/cmd). We have run an earlier version of this bump (fiber 2.52.11, pgx 5.9.0, auth 2.1.2) since 2026-10-31. The versions here are newer because of advisories published since then.govulncheck still reports reachable findings in x/net, x/text, klauspost/compress, brotli and the Go 1.27.0 standard library (fixed in 1.27.2/1.27.3). I left those out to keep this PR to the three modules. Happy to add them, here or in a separate PR.