Security/endorlabs findings - #5181
Open
sourabhpatel-sumo wants to merge 2 commits into
Open
Conversation
grpc: fixes GHSA-vp52-pcj8-j9qc (CVE-2026-84304), a reachable HTTP/2 DATA frame heap exhaustion in the transport this repo serves over etcd. Endor recommended v1.83.1, which still leaves GHSA-2v4p-qf9q-27wj open; v1.83.2 clears it too. x/crypto: fixes 3 SSH CVEs (GO-2026-6303/6354/6355). Unreachable here - the repo imports only bcrypt - but bumped for a clean scan. Signed-off-by: Sourabh Patel <sourabh.patel.ctr@sumologic.com>
checkout v3/v4 -> v7, setup-go v5 -> v7, staticcheck-action v1.3.1 -> v1.4.1. Clears 34 of 45 npm-in-action findings from the Endor scan, including all uuid, form-data and minimatch CVEs pulled in via staticcheck-action's bundled setup-go-faster dependency. Verified: no pull_request_target/workflow_run triggers (checkout v7's fork-PR gate doesn't apply), GOTOOLCHAIN=local satisfied by the pinned go-version matching go.mod, and the Alpine semgrep container has a musl node24 runner build available. Also switch the semgrep container from returntocorp/semgrep to semgrep/semgrep - the former's Docker Hub description says "We've moved!". Confirmed both tags currently resolve to the same image digest, so this is a rename with no behavioral change. Signed-off-by: Sourabh Patel <sourabh.patel.ctr@sumologic.com>
sourabhpatel-sumo
force-pushed
the
security/endorlabs-findings
branch
from
September 9, 2026 16:30
e20e4fd to
e1b4925
Compare
sarvodaya-kumar-26
approved these changes
Sep 10, 2026
Author
|
Need to wait for upstream sensu/core#55 to be merged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this change?
Bumps
actions/checkout,actions/setup-go,dominikh/staticcheck-action, and the semgrep container image in CI, plusgolang.org/x/crypto(v0.54.0→v0.56.0) andgoogle.golang.org/grpc(v1.82.1→v1.83.2) in bothgo.modandtypes/go.mod.Why is this change necessary?
Clears CVEs flagged by an Endor Labs scan against
develop/6:bcryptis imported from this module), but bumped for a clean scan.checkoutv3/v4→v7,setup-gov5→v7,staticcheck-actionv1.3.1→v1.4.1 clears 34 of 45 npm-in-action findings (uuid, form-data, minimatch CVEs pulled in via staticcheck-action's bundled setup-go-faster dependency). Also swapped the semgrep container fromreturntocorp/semgreptosemgrep/semgrep— the former's Docker Hub page says "We've moved!"; both tags currently resolve to the same image digest, so this is a rename with no behavioral change.Does your change need a Changelog entry?
Yes — not yet added. Should go under
## [Unreleased]→### SecurityinCHANGELOG-6.md, following the pattern already used for the v6.14.2 entry (e.g. "Resolved CVE-2026-84304 (grpc HTTP/2 DoS) and 3 SSH CVEs by upgradinggoogle.golang.org/grpcto v1.83.2 andgolang.org/x/cryptoto v0.56.0").How did you verify this change?
checkout@v7's fork-PR gate doesn't apply (nopull_request_target/workflow_runtriggers in this repo's workflows).GOTOOLCHAIN=localis satisfied by the pinnedgo-versionmatchinggo.mod.returntocorp/semgrepandsemgrep/semgrepcurrently resolve to the same image digest.