gh/2.83.1-r2: cve remediation

[octo-sts]

gh/2.83.1-r2: fix GHSA-4qg8-fj49-pxjh

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/gh.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

[octo-sts]

🔢 Build Failed: Dependency Version Mismatch

go: github.com/sigstore/[email protected]: invalid version: go.mod has post-v2 module path "github.com/sigstore/timestamp-authority/v2" at revision v2.0.3

Build Details

Category	Details
Build System	Go/melange
Failure Point	go/bump pipeline step during dependency update

Root Cause Analysis 🔍

The Go module github.com/sigstore/timestamp-authority has an invalid version constraint. The module's go.mod file declares itself as version 2 with path 'github.com/sigstore/timestamp-authority/v2', but the requested version v2.0.3 is being resolved against the v1 path 'github.com/sigstore/timestamp-authority'. This is a Go module versioning issue where the module path and version don't align according to Go's semantic import versioning rules.

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.