Repository navigation
Trivy gate fails every PR on kin-openapi CVEs #55
Description
The problem
Trivy reports three HIGH CVEs in github.com/getkin/kin-openapi v0.147.0, the
library L1 validates every request with. trivy-gate fails on them, so every PR
into development is blocked.
| CVE | Fixed in | Reachable here |
|---|---|---|
| CVE-2026-100352 | v0.148.0 | No — needs YAML bodies on the opt-in JSON Schema 2020 path; we decode JSON and use the built-in visitor |
| CVE-2026-100353 | v0.149.0 | No — only in openapi3filter, which we do not import |
| CVE-2026-100354 | v0.149.0 | No — needs a circular allOf/anyOf/oneOf chain; neither the current spec nor #52's has one, and the spec comes from a trusted URL |
The fix
Bump to v0.150.0, not the v0.149.0 Trivy suggests:
- v0.149.0 stops validating self-referencing schemas below the root, so an
invalid geometry inside aGeometryCollectionpasses L1. v0.150.0 restores it
(upstream #1292). - v0.150.0 drops
constfrom the built-in visitor. No request outcome changes:
context.versionis enforced by the envelope rules, andcontext.actionis
rewritten to its canonical value before L1 runs.
Parent: OpenAgriNet/engineering-tracker#123
Activity
Merge pull request #56 from OpenAgriNet/fix/55-bump-kin-openapi-cve
nisargabd commentedon Oct 22, 2026
The PR related to this issue has been merged