Skip to content

fix(deps): vuln minor upgrades — 11 packages (minor: 7 · patch: 4) [server]#27

Closed
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit intomainfrom
engraver-auto-version-upgrade/minorpatch/go/server/0-1776936166
Closed

fix(deps): vuln minor upgrades — 11 packages (minor: 7 · patch: 4) [server]#27
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit intomainfrom
engraver-auto-version-upgrade/minorpatch/go/server/0-1776936166

Conversation

@gh-worker-campaigns-3e9aa4
Copy link
Copy Markdown

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Apr 23, 2026

Summary: Critical-severity security update — 11 packages upgraded (MINOR changes included)

Manifests changed:

  • server (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
google.golang.org/grpc v1.66.1 v1.80.0 minor Direct 3 CRITICAL
github.com/go-jose/go-jose/v4 v4.0.5 v4.1.4 minor Transitive 1 HIGH
github.com/coreos/go-oidc/v3 v3.11.0 v3.18.0 minor Direct -
github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 v2.29.0 minor Direct -
github.com/labstack/echo/v4 v4.13.4 v4.15.1 minor Direct -
github.com/stretchr/testify v1.10.0 v1.11.1 minor Direct -
github.com/urfave/cli/v2 v2.3.0 v2.27.7 minor Direct -
github.com/gorilla/securecookie v1.1.1 v1.1.2 patch Direct -
go.temporal.io/api v1.62.2 v1.62.9 patch Direct -
google.golang.org/protobuf v1.36.5 v1.36.11 patch Direct -
gopkg.in/validator.v2 v2.0.0-20210331031555-b37d688a7fb0 v2.0.1 patch Direct -

Packages marked with "-" are updated due to dependency constraints.

Security Details

🚨 Critical & High Severity (4 fixed)
Package CVE Severity Summary Unsafe Version Fixed In
google.golang.org/grpc GHSA-p77j-4mvh-x3m3 CRITICAL gRPC-Go has an authorization bypass via missing leading slash in :path v1.66.1 1.79.3
google.golang.org/grpc CVE-2026-33186 CRITICAL gRPC-Go has an authorization bypass via missing leading slash in :path v1.66.1 -
google.golang.org/grpc GO-2026-4762 CRITICAL Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc v1.66.1 1.79.3
github.com/go-jose/go-jose/v4 GHSA-78h2-9frx-2jm8 HIGH Go JOSE Panics in JWE decryption v4.0.5 4.1.4
⚠️ Dependencies that have Reached EOL (2)
Dependency Unsafe Version EOL Date New Version Path
github.com/urfave/cli/v2 v2.3.0 - v2.27.7 server/go.mod
gopkg.in/validator.v2 v2.0.0-20210331031555-b37d688a7fb0 - v2.0.1 server/go.mod

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: Vulnerability Remediation (Critical/High)

🤖 Generated by DataDog Automated Dependency Management System

@campaigner-prod
Copy link
Copy Markdown

campaigner-prod Bot commented Apr 23, 2026

Release Notes

google.golang.org/grpc (v1.66.1 → v1.80.0) — GitHub Release

v1.80.0

Behavior Changes

Bug Fixes

New Features

Performance Improvements

(truncated)

v1.79.3

Security

v1.79.2

Bug Fixes

v1.79.1

Bug Fixes

v1.79.0

API Changes

Behavior Changes

New Features

Bug Fixes

(truncated — see source for full notes)

github.com/go-jose/go-jose/v4 (v4.0.5 → v4.1.4) — GitHub Release

v4.1.4

What's Changed

Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8

Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4

v4.1.3

This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop x/crypto and no longer have any external dependencies in go-jose outside of the standard library!

This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.

What's Changed

Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3

v4.1.2

What's Changed

go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.

New Contributors

Full Changelog: go-jose/go-jose@v4.1.1...v4.1.2

v4.1.1

What's Changed

New Contributors

Full Changelog: go-jose/go-jose@v4.1.0...v4.1.1

v4.1.0

What's Changed

New Contributors

Full Changelog: go-jose/go-jose@v4.0.5...v4.1.0

github.com/coreos/go-oidc/v3 (v3.11.0 → v3.18.0) — GitHub Release

v3.18.0

What's Changed

Full Changelog: coreos/go-oidc@v3.17.0...v3.18.0

v3.17.0

What's Changed

Full Changelog: coreos/go-oidc@v3.16.0...v3.17.0

v3.16.0

What's Changed

New Contributors

Full Changelog: coreos/go-oidc@v3.15.0...v3.16.0

v3.15.0

What's Changed

Full Changelog: coreos/go-oidc@v3.14.1...v3.15.0

v3.14.1

What's Changed

Full Changelog: coreos/go-oidc@v3.14.0...v3.14.1

v3.14.0

What's Changed

Full Changelog: coreos/go-oidc@v3.13.0...v3.14.0

v3.13.0

What's Changed

Full Changelog: coreos/go-oidc@v3.12.0...v3.13.0

v3.12.0

What's Changed

Full Changelog: coreos/go-oidc@v3.11.0...v3.12.0

github.com/grpc-ecosystem/grpc-gateway/v2 (v2.22.0 → v2.29.0) — GitHub Release

v2.29.0

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.28.0...v2.29.0

v2.28.0

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.27.8...v2.28.0

v2.27.8

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.27.7...v2.27.8

v2.27.7

Re-release of v2.26.7 as v2.27.7 for correct semver ordering.

v2.26.7

What's Changed

Full Changelog: grpc-ecosystem/grpc-gateway@v2.27.6...v2.26.7

v2.27.6

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.27.5...v2.27.6

v2.27.5

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.27.4...v2.27.5

v2.27.4

What's Changed

(truncated — see source for full notes)

github.com/labstack/echo/v4 (v4.13.4 → v4.15.1) — GitHub Release

v4.15.0

Security

WARNING: If your application relies on cross-origin or same-site (same subdomain) requests do not blindly push this version to production

The CSRF middleware now supports the Sec-Fetch-Site header as a modern, defense-in-depth approach to CSRF
protection, implementing the OWASP-recommended Fetch Metadata API alongside the traditional token-based mechanism.

How it works:

Modern browsers automatically send the Sec-Fetch-Site header with all requests, indicating the relationship
between the request origin and the target. The middleware uses this to make security decisions:

  • same-origin or none: Requests are allowed (exact origin match or direct user navigation)
  • same-site: Falls back to token validation (e.g., subdomain to main domain)
  • cross-site: Blocked by default with 403 error for unsafe methods (POST, PUT, DELETE, PATCH)

For browsers that don't send this header (older browsers), the middleware seamlessly falls back to
traditional token-based CSRF protection.

New Configuration Options:

  • TrustedOrigins []string: Allowlist specific origins for cross-site requests (useful for OAuth callbacks, webhooks)
  • AllowSecFetchSiteFunc func(echo.Context) (bool, error): Custom logic for same-site/cross-site request validation

Example:

e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
    // Allow OAuth callbacks from trusted provider
    TrustedOrigins: []string{"https://oauth-provider.com"},

    // Custom validation for same-site requests
    AllowSecFetchSiteFunc: func(c echo.Context) (bool, error) {
        // Your custom authorization logic here
        return validateCustomAuth(c), nil
        // return true, err  // blocks r

_(truncated)_

### v4.14.0

`middleware.Logger()` has been deprecated. For request logging, use `middleware.RequestLogger()` or
`middleware.RequestLoggerWithConfig()`.

`middleware.RequestLogger()` replaces `middleware.Logger()`, offering comparable configuration while relying on the
Go standard library’s new `slog` logger.

The previous default output format was JSON. The new default follows the standard `slog` logger settings.
To continue emitting request logs in JSON, configure `slog` accordingly:
```go
slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, nil)))
e.Use(middleware.RequestLogger())

If you are developing anything more substantial than a demo, use middleware.RequestLoggerWithConfig()

Security

What's Changed

(truncated)

github.com/stretchr/testify (v1.10.0 → v1.11.1) — GitHub Release

v1.11.1

This release fixes stretchr/testify#1785 introduced in v1.11.0 where expected argument values implementing the stringer interface (String() string) with a method which mutates their value, when passed to mock.Mock.On (m.On("Method", <expected>).Return()) or actual argument values passed to mock.Mock.Called may no longer match one another where they previously did match. The behaviour prior to v1.11.0 where the stringer is always called is restored. Future testify releases may not call the stringer method at all in this case.

What's Changed

Full Changelog: stretchr/testify@v1.11.0...v1.11.1

v1.11.0

What's Changed

Functional Changes

v1.11.0 Includes a number of performance improvements.

Fixes

Documentation, Build & CI

(truncated)

go.temporal.io/api (v1.62.2 → v1.62.9) — GitHub Release

v1.62.9

Full Changelog: temporalio/api-go@v1.62.8...v1.62.9

v1.62.8

What's Changed

Full Changelog: temporalio/api-go@v1.62.7...v1.62.8

v1.62.7

What's Changed

New Contributors

Full Changelog: temporalio/api-go@v1.62.6...v1.62.7

v1.62.6

What's Changed

New Contributors

Full Changelog: temporalio/api-go@v1.62.5...v1.62.6

v1.62.5

Full Changelog: temporalio/api-go@v1.62.4...v1.62.5

v1.62.4

Full Changelog: temporalio/api-go@v1.62.3...v1.62.4

v1.62.3

What's Changed

New Contributors

Full Changelog: temporalio/api-go@v1.62.2...v1.62.3

google.golang.org/protobuf (v1.36.5 → v1.36.11) — GitHub Release

v1.36.11

Full Changelog: protocolbuffers/protobuf-go@v1.36.10...v1.36.11

User-visible changes:
CL/726780: encoding/prototext: Support URL chars in type URLs in text-format.

Bug fixes:
CL/728680: internal/impl: check recursion limit in lazy decoding validation
CL/711015: reflect/protodesc: fix handling of import options in dynamic builds

Maintenance:
CL/728681: reflect/protodesc: add support for edition unstable
CL/727960: all: add EDITION_UNSTABLE support
CL/727940: types: regenerate using latest protobuf v33.2 release
CL/727140: internal/testprotos/lazy: convert .proto files to editions
CL/723440: cmd/protoc-gen-go: add missing annotations for few generated protobuf symbols.
CL/720980: internal/filedesc: remove duplicative Message.unmarshalOptions
CL/716360: internal/encoding/tag: use proto3 defaults if proto3
CL/716520: proto: un-flake TestHasExtensionNoAlloc
CL/713342: compiler/protogen: properly filter option dependencies in go-protobuf plugin.
CL/711200: proto: add test for oneofs containing messages with required fields
CL/710855: proto: add explicit test for a non-nil but empty byte slice

v1.36.10

Full Changelog: protocolbuffers/protobuf-go@v1.36.9...v1.36.10

Bug fixes:
CL/704415: reflect/protodesc: edition-2024-specific properties should not be lost when converting FileDescriptorProto to protoreflect.FileDescriptor

Maintenance:
CL/708555: internal/race_test: add missing impl.LazyEnabled() t.Skip
CL/703295: proto: add more invalid group encoding test cases
CL/703276: internal/impl: verify lazy unmarshal on Deterministic encoding
CL/703275: internal/impl: stop using deprecated .Field in lazy_test.go
CL/702795: all: update to latest github.com/google/go-cmp

v1.36.9

Full Changelog: protocolbuffers/protobuf-go@v1.36.8...v1.36.9

User-visible changes:
CL/699715: cmd/protoc-gen-go: add test for "import option" directive
CL/699115: internal/editionssupport: declare support for edition 2024
CL/697595: editions: Fix spelling mistake in panic message

v1.36.8

Maintenance:

CL/696316: all: set Go language version to Go 1.23
CL/696315: types: regenerate using latest protobuf v32 release

v1.36.7

Maintenance / optimizations:

CL/683955: encoding/protowire: micro-optimize SizeVarint (-20% on Intel)
CL/674055: internal/impl: remove unnecessary atomic access for non-lazy lists
CL/674015: impl: remove unnecessary nil check from presence.Present
CL/673495: types/descriptorpb: regenerate using latest protobuf v31 release
CL/670516: cmd/protoc-gen-go: centralize presence and lazy logic into filedesc
CL/670515: internal: move usePresenceForField to internal/filedesc
CL/670275: internal/impl: clean up usePresenceForField() (no-op)

v1.36.6

Full Changelog: protocolbuffers/protobuf-go@v1.36.5...v1.36.6

User-visible changes:
CL/657895: internal_gengo: generate a const string literal for the raw descriptor
CL/653536: proto: Add CloneOf[M Message](m M) M

Maintenance:
CL/649135: all: set Go language version to Go 1.22
CL/654955: types/descriptorpb: regenerate using latest protobuf v30 release

Generated by ADMS Sources: 8 GitHub Releases, 3 not available.

@seberm-6
Copy link
Copy Markdown

seberm-6 commented Apr 23, 2026

Hey, sorry for the noise. This was caused by a bug in our automated dependency update system that incorrectly included upstream changelog content in PR comments, triggering notifications to external contributors. The feature flag has been turned off and we're working on a fix. Sorry about that again.

@campaigner-prod campaigner-prod Bot closed this Apr 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-critical-severity adms-dependency-update adms-fixes-eol adms-go adms-high-severity adms-minor-update adms-mode-all-updates campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seberm-6