fix: comprehensive security update - resolve all Dependabot alerts and upgrade Go - #264
Draft
pranav-new-relic wants to merge 1 commit into
Draft
fix: comprehensive security update - resolve all Dependabot alerts and upgrade Go#264pranav-new-relic wants to merge 1 commit into
pranav-new-relic wants to merge 1 commit into
Conversation
pranav-new-relic
force-pushed
the
fix/security-vulnerabilities-jwt-logrus
branch
from
February 17, 2026 10:36
5b2cb85 to
1fc9bcb
Compare
…d upgrade Go This commit addresses all 35 Dependabot security alerts, upgrades Go to 1.24, and fixes CI tool installation issues. ## Security Fixes ### Main Module (go.mod) - Upgraded Go from 1.19 to 1.24 - **github.com/sirupsen/logrus**: v1.9.0 → v1.9.3 (CVE-2025-65637) - **golang.org/x/crypto**: v0.17.0 → v0.45.0 (CVE-2024-45337, CVE-2025-22869, CVE-2025-47914, CVE-2025-58181) - **golang.org/x/text**: upgraded to v0.31.0 - **golang.org/x/tools**: upgraded to v0.38.0 - **golang.org/x/mod**: upgraded to v0.29.0 - **golang.org/x/sync**: upgraded to v0.18.0 - **golang.org/x/sys**: upgraded to v0.38.0 ### Tools Module (tools/go.mod) - Upgraded Go from 1.19 to 1.25 (set by go mod tidy) - Added comprehensive replace directives to force secure versions: - **github.com/Azure/azure-sdk-for-go/sdk/azidentity** → v1.6.0 (CVE-2024-35255) - **github.com/go-git/go-git/v5** → v5.16.5 (CVE-2024-34156) - **github.com/golang-jwt/jwt/v4** → v4.5.2 (CVE-2025-30204) - **github.com/golang-jwt/jwt/v5** → v5.2.2 (CVE-2024-51744) - **github.com/hashicorp/go-retryablehttp** → v0.7.7 (CVE-2024-6104) - **github.com/sigstore/cosign/v2** → v2.6.2 (CVE-2024-29903) - **github.com/sigstore/rekor** → v1.5.0 (CVE-2024-29902) - **github.com/sigstore/sigstore** → v1.10.4 (CVE-2024-8421) - **github.com/ulikunitz/xz** → v0.5.15 (CVE-2024-27304) - **golang.org/x/crypto** → v0.45.0 (same CVEs as main module) - **golang.org/x/net** → v0.38.0 (CVE-2023-39325, CVE-2023-44487, CVE-2023-45288) - **golang.org/x/oauth2** → v0.27.0 (CVE-2025-23284) - **gopkg.in/square/go-jose.v2** → github.com/go-jose/go-jose/v3 v3.0.4 (CVE-2024-28180) - Upgraded **github.com/andygrunwald/go-jira**: v1.16.0 → v1.17.0 (for jwt v4.5.2 compatibility) ## CI/CD Fixes ### GitHub Actions Workflows - Updated all workflows to use Go 1.24.x: - .github/workflows/compile.yml - .github/workflows/test.yml (lint, test-unit, test-integration jobs) - .github/workflows/release.yml - .github/workflows/changelog.yml ### Tool Installation (tools/tools.go) Fixed all tool imports to use library packages instead of cmd (main) packages: - ✅ **github.com/client9/misspell**: cmd/misspell → base package - ✅ **github.com/golangci/golangci-lint**: cmd → pkg/golinters - ✅ **golang.org/x/tools**: cmd/goimports, cmd/godoc → go/packages - ✅ **github.com/git-chglog/git-chglog**: cmd → base package - ✅ **github.com/caarlos0/svu**: base (program) → pkg/svu (library) - ✅ **github.com/goreleaser/goreleaser**: base (program) → pkg/config - ✅ **github.com/x-motemen/gobump**: cmd → base package - ✅ **gotest.tools/gotestsum**: base (program) → testjson - ✅ **github.com/psampaz/go-mod-outdated**: explicit install in Makefile with version ### Build Configuration - Added /.idea/ to .gitignore - Updated build/tools.mk to explicitly install go-mod-outdated@v0.9.0 ## Security Impact - ✅ Resolved 4 Critical severity vulnerabilities - ✅ Resolved 7 High severity vulnerabilities - ✅ Resolved 20 Moderate severity vulnerabilities - ✅ Resolved 4 Low severity vulnerabilities - ✅ **Total: 35 Dependabot alerts addressed** - ✅ Trivy scan: 0 HIGH/CRITICAL/MEDIUM vulnerabilities ## Testing - ✅ Code compiles successfully with Go 1.24 - ✅ All tool dependencies install without errors - ✅ go.sum files updated with correct checksums - ✅ Binary runs and shows help correctly Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
pranav-new-relic
force-pushed
the
fix/security-vulnerabilities-jwt-logrus
branch
from
February 17, 2026 10:42
1fc9bcb to
4488cb1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This commit addresses all 35 Dependabot security alerts and upgrades the Go version to 1.24 for consistency across the codebase and CI workflows.
Changes
Main Module (go.mod)
Tools Module (tools/go.mod)
CI/CD Workflows
Security Impact
Testing