fix(deps): clear the HIGH/CRITICAL CVEs failing the trivy CI gate #15

2026-08-24T23:01:44Z

sharang commented

2026-08-24 23:01:44 +00:00

The required 'shared' check has been red on every run for months — root cause was not CI infrastructure but 14 real HIGH/CRITICAL dependency findings. This bumps kin-openapi (CRITICAL fail-open), golang.org/x/crypto (ssh CVEs), golang.org/x/text, and moby/go-archive to fixed versions. Full suite incl. postgres testcontainers green.

🤖 Generated with Claude Code

The required 'shared' check has been red on every run for months — root cause was not CI infrastructure but 14 real HIGH/CRITICAL dependency findings. This bumps kin-openapi (CRITICAL fail-open), golang.org/x/crypto (ssh CVEs), golang.org/x/text, and moby/go-archive to fixed versions. Full suite incl. postgres testcontainers green. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sharang added 1 commit 2026-08-24 23:01:45 +00:00

fix(deps): bump kin-openapi, x/crypto, x/text, go-archive past HIGH/CRITICAL CVEs

ci / shared (pull_request) Successful in 12s

Details

ci / test (pull_request) Successful in 21m14s

Details

ci / image (pull_request) Skipped

Details

47c6725dba

Clears the 14 findings (13 HIGH, 1 CRITICAL) that have had the trivy fs
gate in the shared CI job red on every run: kin-openapi 0.138.0 -> 0.144.0
(GHSA-r277-6w6q-xmqw ValidationHandler fail-open + CVE-2026-76905),
x/crypto 0.51.0 -> 0.55.0 (ssh CVE-2026-39828..39835, 42508, 46595,
46597), x/text -> 0.41.0 (CVE-2026-56852), moby/go-archive 0.2.0 -> 0.3.0
(CVE-2026-17106). Full suite incl. postgres harness green; openapi
contract test passes against kin-openapi 0.144.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit 739b19341c into main

2026-08-25 08:49:04 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: platform/tenant-registry#15