Repository navigation
fix: bump kin-openapi off the CVE-affected version [#55] - #56
Merged
Merged
Conversation
kin-openapi v0.147.0 carries CVE-2026-100352, -100353 and -100354, all HIGH. trivy-gate fails on them, so every PR into development is blocked. None is reachable here: we decode JSON and use the built-in visitor, never import openapi3filter, and neither spec has a circular allOf/anyOf/oneOf chain. v0.150.0, not the v0.149.0 Trivy names. v0.149.0's cycle guard stops validating self-referencing schemas below the root, so an invalid member of a GeometryCollection passes L1; v0.150.0 restores that. Pinning back to v0.149.0 reopens the hole. v0.150.0 also stops checking const in the built-in visitor. That changes no request outcome: context.version is enforced by the envelope rules, and context.action is rewritten to its canonical value before L1 runs. A differential run of 1,416 bodies through ValidateEnvelope and L1 gave the same verdict, message and path as v0.147.0, on both the current spec and #52's. Transitively santhosh-tekuri/jsonschema/v6 v6.0.2 -> v6.0.3.
🛡️ Trivy security scan (CRITICAL,HIGH,MEDIUM,LOW)Go dependenciesNo findings at CRITICAL,HIGH,MEDIUM,LOW. Container imageNo findings at CRITICAL,HIGH,MEDIUM,LOW. |
|
📊 Test Coverage: ➖ Not applicable — no non-test Go files changed vs |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
trivy-gatefails every PR intodevelopmenton three HIGH CVEs ingithub.com/getkin/kin-openapiv0.147.0 (CVE-2026-100352, -100353, -100354).This bumps it to v0.150.0.
go.mod/go.sumonly, no code change.None of the three is reachable here. The bump clears the gate.
Why v0.150.0, not the v0.149.0 Trivy suggests
geometry inside a
GeometryCollectionpasses L1 on it. v0.150.0 restores this.constin the built-in visitor. No request outcomechanges:
context.versionis enforced by the envelope rules, andcontext.actionis rewritten to its canonical value before L1 runs.Testing
ValidateEnvelope+L1make buildmake test-cimake trivy-depsmake verify/make newman/make auditmake lint(Go 1.26.6)src/platform/telemetry/testsupport.go, already ondevelopmentand not touched hereCloses #55
Checklist