Skip to content

Commit 107a5e9

Browse files
alnralnr
authored
feat: add perform device-code, make update oauth2-client non-destructive, report key set in get jwk (#448)
* chore: update hydra and ory/x dependencies Bumps github.com/ory/hydra/v2 to 20260727152228-962ddb5de40a. Two user-visible changes come along with this: - `ory update oauth2-client` now PATCHes only the flags that were actually set instead of PUTing the whole client, so fields you did not pass are no longer reset to their defaults. Passing --file keeps the previous replace-everything semantics. - `ory get jwk` now emits a per-key `set` field, and the collection-level `set` is omitted when results span multiple sets. * feat: add `ory perform device-code` Wires hydra's device code flow command into `ory perform`, alongside `authorization-code` and `client-credentials`. * fix: bump kin-openapi to v0.144.0 to clear critical CVE The Docker Image Scan gates on `severity-cutoff: critical` and started failing on GHSA-r277-6w6q-xmqw, a fail-open authentication bypass in kin-openapi's ValidationHandler.Load() via the NoopAuthenticationFunc default, affecting <= 0.143.0. This repo only uses openapi2/openapi2conv to convert Swagger 2.0 specs to OpenAPI 3.0 in `ory dev openapi migrate`, so the vulnerable validation middleware is never reached, but the scanner gates on the resolved version regardless. Converting a Swagger 2.0 fixture covering path/query/body parameters, $ref'd definitions and an accessCode security definition produces byte-identical output before and after the bump.
1 parent 3e534d2 commit 107a5e9

4 files changed

Lines changed: 49 additions & 50 deletions

File tree

‎cmd/cloudx/oauth2/flows.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,7 @@ func NewPerformAuthorizationCode() *cobra.Command {
1616
func NewPerformClientCredentials() *cobra.Command {
1717
return wrapHydraCmd(hydra.NewPerformClientCredentialsCmd)
1818
}
19+
20+
func NewPerformDeviceCode() *cobra.Command {
21+
return wrapHydraCmd(hydra.NewPerformDeviceCodeCmd)
22+
}

‎cmd/cloudx/perform.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ func NewPerformCmd() *cobra.Command {
2121
cmd.AddCommand(
2222
oauth2.NewPerformAuthorizationCode(),
2323
oauth2.NewPerformClientCredentials(),
24+
oauth2.NewPerformDeviceCode(),
2425
)
2526

2627
client.RegisterConfigFlag(cmd.PersistentFlags())

‎go.mod‎

Lines changed: 14 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ require (
99
github.com/Masterminds/semver/v3 v3.5.0
1010
github.com/bradleyjkemp/cupaloy/v2 v2.8.0
1111
github.com/evanphx/json-patch v5.9.0+incompatible
12-
github.com/getkin/kin-openapi v0.131.0
12+
github.com/getkin/kin-openapi v0.144.0
1313
github.com/ghodss/yaml v1.0.0
1414
github.com/go-jose/go-jose/v3 v3.0.5
1515
github.com/gofrs/uuid v4.4.0+incompatible
@@ -21,11 +21,11 @@ require (
2121
github.com/ory/graceful v0.2.0
2222
github.com/ory/herodot v0.10.9-0.20260330111132-da75ef0fbc22
2323
github.com/ory/hydra-client-go/v2 v2.4.0-alpha.1.0.20251107123905-f3d35665821b
24-
github.com/ory/hydra/v2 v2.3.1-0.20260608173701-e93cfd611f53
24+
github.com/ory/hydra/v2 v2.3.1-0.20260727152228-962ddb5de40a
2525
github.com/ory/jsonschema/v3 v3.0.9-0.20250317235931-280c5fc7bf0e
2626
github.com/ory/keto v0.14.1-0.20260609063042-5da3a68a58d9
2727
github.com/ory/kratos v1.3.1-0.20260709105504-7b4ac2b73600
28-
github.com/ory/x v0.0.730-0.20260708100811-e26a5b71beb3
28+
github.com/ory/x v0.0.730-0.20260727152226-615c3d55f207
2929
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
3030
github.com/pkg/errors v0.9.1
3131
github.com/rs/cors v1.11.1
@@ -37,7 +37,7 @@ require (
3737
github.com/tidwall/sjson v1.2.5
3838
github.com/urfave/negroni v1.0.0
3939
golang.org/x/oauth2 v0.36.0
40-
golang.org/x/text v0.38.0
40+
golang.org/x/text v0.39.0
4141
gopkg.in/yaml.v2 v2.4.0
4242
)
4343

@@ -142,12 +142,11 @@ require (
142142
github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
143143
github.com/jackc/pgpassfile v1.0.0 // indirect
144144
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
145-
github.com/jackc/pgx/v5 v5.9.2 // indirect
145+
github.com/jackc/pgx/v5 v5.10.0 // indirect
146146
github.com/jackc/puddle/v2 v2.2.2 // indirect
147147
github.com/jaegertracing/jaeger-idl v0.9.0 // indirect
148148
github.com/jmoiron/sqlx v1.4.0 // indirect
149149
github.com/joho/godotenv v1.5.1 // indirect
150-
github.com/josharian/intern v1.0.0 // indirect
151150
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
152151
github.com/knadh/koanf/maps v0.1.2 // indirect
153152
github.com/knadh/koanf/parsers/json v1.0.0 // indirect
@@ -164,7 +163,6 @@ require (
164163
github.com/lestrrat-go/option v1.0.1 // indirect
165164
github.com/lib/pq v1.12.3 // indirect
166165
github.com/magiconair/properties v1.8.9 // indirect
167-
github.com/mailru/easyjson v0.9.2 // indirect
168166
github.com/mattn/go-colorable v0.1.14 // indirect
169167
github.com/mattn/go-isatty v0.0.22 // indirect
170168
github.com/mattn/goveralls v0.0.12 // indirect
@@ -181,8 +179,8 @@ require (
181179
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
182180
github.com/ncruces/go-strftime v1.0.0 // indirect
183181
github.com/nyaruka/phonenumbers v1.7.4 // indirect
184-
github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
185-
github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
182+
github.com/oasdiff/yaml v0.1.1 // indirect
183+
github.com/oasdiff/yaml3 v0.0.14 // indirect
186184
github.com/oklog/ulid/v2 v2.1.1 // indirect
187185
github.com/opencontainers/go-digest v1.0.0 // indirect
188186
github.com/opencontainers/image-spec v1.1.1 // indirect
@@ -195,11 +193,10 @@ require (
195193
github.com/ory/kratos-client-go v1.3.9-0.20251107123727-a6ddbd382e38 // indirect
196194
github.com/ory/mail/v3 v3.0.1-0.20260416102637-e762925f059d // indirect
197195
github.com/ory/nosurf v1.2.7 // indirect
198-
github.com/ory/pop/v6 v6.4.2-0.20260507161217-89126558d369 // indirect
196+
github.com/ory/pop/v6 v6.4.2-0.20260714091811-7f2223c43ab6 // indirect
199197
github.com/pborman/uuid v1.2.1 // indirect
200198
github.com/pelletier/go-toml v1.9.5 // indirect
201199
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
202-
github.com/perimeterx/marshmallow v1.1.5 // indirect
203200
github.com/peterhellberg/link v1.2.0 // indirect
204201
github.com/philhofer/fwd v1.2.0 // indirect
205202
github.com/pkg/profile v1.7.0 // indirect
@@ -214,6 +211,7 @@ require (
214211
github.com/sagikazarmark/locafero v0.4.0 // indirect
215212
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
216213
github.com/samber/lo v1.53.0 // indirect
214+
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
217215
github.com/sawadashota/encrypta v0.0.5 // indirect
218216
github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761 // indirect
219217
github.com/segmentio/backo-go v1.1.0 // indirect
@@ -236,7 +234,6 @@ require (
236234
github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80 // indirect
237235
github.com/toqueteos/webbrowser v1.2.0 // indirect
238236
github.com/twmb/murmur3 v1.1.8 // indirect
239-
github.com/ugorji/go v1.1.4 // indirect
240237
github.com/wI2L/jsondiff v0.7.1 // indirect
241238
github.com/x448/float16 v0.8.4 // indirect
242239
github.com/xtgo/uuid v0.0.0-20140804021211-a0b114877d4c // indirect
@@ -264,15 +261,15 @@ require (
264261
go.yaml.in/yaml/v3 v3.0.4 // indirect
265262
golang.org/x/crypto v0.53.0 // indirect
266263
golang.org/x/exp v0.0.0-20260508232706-74f9aab9d74a // indirect
267-
golang.org/x/mod v0.36.0 // indirect
268-
golang.org/x/net v0.55.0 // indirect
264+
golang.org/x/mod v0.37.0 // indirect
265+
golang.org/x/net v0.56.0 // indirect
269266
golang.org/x/sync v0.21.0 // indirect
270267
golang.org/x/sys v0.46.0 // indirect
271-
golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6 // indirect
272-
golang.org/x/tools v0.45.0 // indirect
268+
golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 // indirect
269+
golang.org/x/tools v0.47.0 // indirect
273270
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
274271
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
275-
google.golang.org/grpc v1.81.1 // indirect
272+
google.golang.org/grpc v1.82.1 // indirect
276273
google.golang.org/protobuf v1.36.11 // indirect
277274
gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
278275
gopkg.in/ini.v1 v1.67.0 // indirect

0 commit comments

Comments
 (0)