Skip to content

Fix/upgrade vulnerable dependencies - #56

Open
raviguptan-sumo wants to merge 4 commits into
mainfrom
fix/upgrade-vulnerable-dependencies
Open

Fix/upgrade vulnerable dependencies#56
raviguptan-sumo wants to merge 4 commits into
mainfrom
fix/upgrade-vulnerable-dependencies

Conversation

@raviguptan-sumo

Copy link
Copy Markdown

Summary

  • Upgrade transitive dependencies to resolve 32 CVEs across golang-jwt, logrus, golang.org/x/net, golang.org/x/sys, golang.org/x/text, grpc, protobuf, and yaml.v3
  • Update GitHub Actions workflows to Go 1.25 and latest action versions (checkout@v4, setup-go@v5, goreleaser-action@v6, golangci-lint-action@v9)
  • Upgrade golangci-lint to v2.13 to fix CI failure caused by lint tool being built with Go 1.24 while targeting Go 1.25

raviguptan-sumo and others added 4 commits August 20, 2026 13:33
Update vulnerable indirect dependencies to patched versions:
- golang-jwt/jwt/v4: v4.0.0 → v4.5.2
- sirupsen/logrus: v1.8.0 → v1.9.3
- golang.org/x/net: v0.0.0-20210525 → v0.56.0
- golang.org/x/sys: v0.0.0-20210603 → v0.46.0
- golang.org/x/text: v0.3.6 → v0.39.0
- google.golang.org/grpc: v1.38.0 → v1.82.1
- google.golang.org/protobuf: v1.26.0 → v1.36.11
- gopkg.in/yaml.v3: v3.0.0-20200313 → v3.0.1

Go directive bumped from 1.18 to 1.25.0 as required by updated deps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ions

- test.yml: Go 1.22 → 1.25, checkout@v2 → v4, setup-go@v1 → v5
- release.yml: Go 1.22.x → 1.25.x, checkout@v2 → v4, setup-go@v1 → v5, goreleaser-action@v1 → v6
- lint.yml: checkout@v2 → v4, golangci-lint-action@v2 → v6, add explicit Go 1.25 setup

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fixes CI failure where golangci-lint v1.64.8 (built with Go 1.24)
could not lint code targeting Go 1.25. Also resolves Node 20
deprecation warning.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove trailing newlines and lowercase error messages per Go
conventions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants