Skip to content

Feat/85 fix the open security and vulnerability findings #88

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
manjudr merged 7 commits into from
Oct 23, 2026
Merged

Feat/85 fix the open security and vulnerability findings #88

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
1f55922
fix: harden plugin unzip against symlinks, zip bombs and FD leaks [#85]
kelvinprabhu Oct 22, 2026
dd39ce0
fix: bump kin-openapi to v0.149.0 to clear Trivy CVEs [#85]
kelvinprabhu Oct 22, 2026
21a679f
test: cover absolute-path and oversized entries in plugin unzip [#85]
kelvinprabhu Oct 22, 2026
8d53c77
chore: bump Go to 1.26.10 [#85]
kelvinprabhu Oct 22, 2026
b105636
revert: drop plugin unzip hardening from #85 scope
kelvinprabhu Oct 22, 2026
54a0ffb
fix: add deprecation notice for unmaintained openpgp package in .triv…
kelvinprabhu Oct 22, 2026
4bb7b7e
docs: shorten the GO-2026-5932 note in .trivyignore [#85]
kelvinprabhu Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,7 @@
# place so the fixed build is picked up the moment Chainguard publishes it --
# remove this line at that point, not before.
CVE-2026-85091

# GO-2026-5932: x/crypto/openpgp is unmaintained and has no fix; we never import it
# (only blake2b and pbkdf2). Remove this line if anything starts importing openpgp.
GO-2026-5932
2 changes: 1 addition & 1 deletion Dockerfile.adapter
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM golang:1.26.9-bookworm AS builder
FROM golang:1.26.10-bookworm AS builder

WORKDIR /workspace/app
COPY cmd/adapter ./cmd/adapter
Expand Down
2 changes: 1 addition & 1 deletion Dockerfile.adapter-with-plugins
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM golang:1.26.9-bookworm AS builder
FROM golang:1.26.10-bookworm AS builder

WORKDIR /workspace/app

Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ Results land in `benchmarks/results/<timestamp>/`. The latest committed report i

### Prerequisites

- Go 1.26.9 or higher — the version `go.mod` requires, and the floor that
- Go 1.26.10 or higher — the version `go.mod` requires, and the floor that
clears the current Go standard-library advisories (`make security`)
- Redis (for caching)
- Docker (optional, for containerized deployment)
Expand Down
6 changes: 3 additions & 3 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
module github.com/beckn-one/beckn-onix

go 1.26.9
go 1.26.10

require (
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
golang.org/x/crypto v0.57.0
)

Expand Down Expand Up @@ -93,7 +93,7 @@ require (
github.com/alicebob/miniredis/v2 v2.37.0
github.com/beckn/catalog-core v0.2.0
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1
github.com/getkin/kin-openapi v0.144.0
github.com/getkin/kin-openapi v0.149.0
github.com/google/uuid v1.6.0
github.com/hashicorp/go-retryablehttp v0.7.8
github.com/hashicorp/vault/api v1.23.0
Expand Down
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,8 +44,8 @@ github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8
github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0=
github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
github.com/getkin/kin-openapi v0.144.0 h1:hIRcTH+KjLfkLpYU6bSSfdFpi0fZi1fp+hSPi4aQu9Y=
github.com/getkin/kin-openapi v0.144.0/go.mod h1:3BH9M9XDe/y9M5DSvEocVYAYq1w0qrhJHjC/vZi0AaY=
github.com/getkin/kin-openapi v0.149.0 h1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isdtMDfA=
github.com/getkin/kin-openapi v0.149.0/go.mod h1:1+BHDzstro+P5CKtPy1X4PfofnFgmRe6uvMy9+r9fKY=
github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
Expand Down Expand Up @@ -181,8 +181,8 @@ github.com/rs/zerolog v1.35.1 h1:m7xQeoiLIiV0BCEY4Hs+j2NG4Gp2o2KPKmhnnLiazKI=
github.com/rs/zerolog v1.35.1/go.mod h1:EjML9kdfa/RMA7h/6z6pYmq1ykOuA8/mjWaEvGI+jcw=
github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0=
github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
Expand Down
Loading