Update module github.com/go-jose/go-jose/v4 to v4.1.4 [SECURITY] - autoclosed by renovate[bot] · Pull Request #4229 · PeerDB-io/peerdb

renovate · 2026-04-23T23:26:30Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-jose/go-jose/v4	`v4.1.3` → `v4.1.4`

Go JOSE Panics in JWE decryption

CVE-2026-34986 / GHSA-78h2-9frx-2jm8

More information

Details

Impact

Decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key.

This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected.

This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common.

Panics can lead to denial of service.

Fixed In

4.1.4 and v3.0.5

Workarounds

If the list of keyAlgorithms passed to ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() does not include key wrapping algorithms (those ending in KW), your application is unaffected.

If your application uses key wrapping, you can prevalidate to the JWE objects to ensure the encrypted_key field is nonempty. If your application accepts JWE Compact Serialization, apply that validation to the corresponding field of that serialization (the data between the first and second .).

Thanks

Thanks to Datadog's Security team for finding this issue.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

go-jose/go-jose (github.com/go-jose/go-jose/v4)

`v4.1.4`

Compare Source

What's Changed

Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8

Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4

Configuration

📅 Schedule: (in timezone Etc/UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-04-23T23:26:34Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: flow/go.sum

Command failed: go get -t ./...
go: downloading github.com/urfave/cli/v3 v3.8.0
go: downloading go.temporal.io/sdk v1.41.1
go: downloading go.uber.org/automaxprocs v1.6.0
go: downloading github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6
go: downloading github.com/jackc/pgx/v5 v5.9.1
go: downloading github.com/yuin/gopher-lua v1.1.1
go: downloading go.opentelemetry.io/otel v1.42.0
go: downloading go.opentelemetry.io/otel/metric v1.42.0
go: downloading go.temporal.io/api v1.62.6
go: downloading golang.org/x/sync v0.20.0
go: downloading github.com/ClickHouse/ch-go v0.71.0
go: downloading github.com/ClickHouse/clickhouse-go/v2 v2.43.0
go: downloading github.com/aws/aws-sdk-go-v2 v1.41.5
go: downloading github.com/aws/aws-sdk-go-v2/service/ses v1.34.22
go: downloading github.com/go-mysql-org/go-mysql v1.14.0
go: downloading github.com/slack-go/slack v0.20.0
go: downloading go.mongodb.org/mongo-driver/v2 v2.5.0
go: downloading golang.org/x/crypto v0.49.0
go: downloading github.com/pingcap/errors v0.11.5-0.20250523034308-74f78ae071ee
go: downloading github.com/gogo/googleapis v1.4.1
go: downloading github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
go: downloading go.opentelemetry.io/otel/sdk v1.42.0
go: downloading go.temporal.io/sdk/contrib/opentelemetry v0.7.0
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260330182312-d5a96adf58d8
go: downloading google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217
go: downloading google.golang.org/grpc v1.79.3
go: downloading k8s.io/apimachinery v0.35.3
go: downloading k8s.io/client-go v0.35.3
go: downloading golang.org/x/mod v0.34.0
go: downloading github.com/quasilyte/go-ruleguard/dsl v0.3.23
go: downloading cloud.google.com/go/auth v0.18.1
go: downloading cloud.google.com/go/storage v1.59.2
go: downloading github.com/apache/arrow-go/v18 v18.5.2
go: downloading github.com/hamba/avro/v2 v2.31.0
go: downloading github.com/aws/aws-sdk-go-v2/service/s3 v1.98.0
go: downloading github.com/elastic/go-elasticsearch/v8 v8.19.3
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/messaging/azeventhubs/v2 v2.0.2
go: downloading github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/eventhub/armeventhub v1.3.0
go: downloading github.com/orcaman/concurrent-map/v2 v2.0.1
go: downloading github.com/jackc/pglogrepl v0.0.0-20251213150135-2e8d0df862c1
go: downloading github.com/twmb/franz-go/pkg/kadm v1.17.2
go: downloading github.com/twmb/franz-go v1.20.7
go: downloading github.com/twmb/franz-go/plugin/kslog v1.0.0
go: downloading github.com/json-iterator/go v1.1.12
go: downloading github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
go: downloading github.com/pingcap/tidb/pkg/parser v0.0.0-20260331182218-500f1607530b
go: downloading github.com/pingcap/tidb v0.0.0-20250130070702-43f2fb91d740
go: downloading github.com/twpayne/go-geos v0.20.3
go: downloading github.com/Shopify/toxiproxy/v2 v2.12.0
go: downloading github.com/pgvector/pgvector-go v0.3.0
go: downloading github.com/snowflakedb/gosnowflake v1.19.0
go: downloading github.com/PeerDB-io/gluajson v1.0.2
go: downloading github.com/aws/aws-sdk-go-v2/config v1.32.13
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.19.13
go: downloading github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.21
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.41.10
go: downloading github.com/cockroachdb/pebble/v2 v2.1.4
go: downloading github.com/aws/aws-sdk-go-v2/service/kms v1.50.4
go: downloading golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
go: downloading github.com/joho/godotenv v1.5.1
go: downloading github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3
go: downloading github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
go: downloading github.com/lestrrat-go/httprc/v3 v3.0.5
go: downloading github.com/lestrrat-go/jwx/v3 v3.0.13
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20260330182312-d5a96adf58d8
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.42.0
go: downloading github.com/PeerDB-io/glua64 v1.0.1
go: downloading github.com/PeerDB-io/gluabit32 v1.0.2
go: downloading github.com/PeerDB-io/gluamsgpack v1.0.5
go: downloading github.com/PeerDB-io/gluautf8 v1.0.0
go: downloading golang.org/x/tools v0.43.0
go: downloading github.com/aws/aws-sdk-go-v2/service/sns v1.39.15
go: downloading github.com/nickbruun/pgsplit v0.0.0-20240103043353-43e6c2dddfad
go: downloading github.com/xdg-go/scram v1.2.0
go: downloading github.com/nexus-rpc/sdk-go v0.6.0
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/segmentio/asm v1.2.1
go: downloading go.opentelemetry.io/otel/trace v1.42.0
go: downloading github.com/andybalholm/brotli v1.2.1
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21
go: downloading filippo.io/edwards25519 v1.2.0
go: downloading golang.org/x/text v0.35.0
go: downloading github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
go: downloading github.com/klauspost/compress v1.18.5
go: downloading golang.org/x/net v0.52.0
go: downloading k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
go: downloading sigs.k8s.io/randfill v1.0.0
go: downloading github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
go: downloading k8s.io/klog/v2 v2.140.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0
go: downloading go.opentelemetry.io/contrib/detectors/gcp v1.42.0
go: downloading github.com/go-viper/mapstructure/v2 v2.5.0
go: downloading golang.org/x/oauth2 v0.36.0
go: downloading github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21
go: downloading github.com/elastic/elastic-transport-go/v8 v8.10.0
go: downloading github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0
go: downloading github.com/Azure/go-amqp v1.5.1
go: downloading github.com/jackc/pgio v1.0.0
go: downloading github.com/twmb/franz-go/pkg/kmsg v1.12.0
go: downloading github.com/pierrec/lz4/v4 v4.1.26
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/goccy/go-json v0.10.6
go: downloading github.com/pingcap/failpoint v0.0.0-20251231045439-91d91e123837
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21
go: downloading github.com/gabriel-vasile/mimetype v1.4.13
go: downloading github.com/golang-jwt/jwt/v5 v5.3.1
go: downloading golang.org/x/sys v0.42.0
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6
go: downloading github.com/aws/aws-sdk-go-v2/service/signin v1.0.9
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.30.14
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.18
go: downloading github.com/cockroachdb/crlib v0.0.0-20251122031428-fe658a2dbda1
go: downloading github.com/cockroachdb/errors v1.12.0
go: downloading github.com/cockroachdb/redact v1.1.8
go: downloading github.com/cockroachdb/tokenbucket v0.0.0-20250429170803-42689b6311bb
go: downloading github.com/prometheus/client_golang v1.23.2
go: downloading github.com/jackc/puddle/v2 v2.2.2
go: downloading github.com/lestrrat-go/blackmagic v1.0.4
go: downloading github.com/lestrrat-go/httpcc v1.0.1
go: downloading github.com/lestrrat-go/option/v2 v2.0.0
go: downloading github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1
go: downloading go.opentelemetry.io/proto/otlp v1.10.0
go: downloading github.com/x448/float16 v0.8.4
go: downloading golang.org/x/time v0.15.0
go: downloading github.com/paulmach/orb v0.13.0
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21
go: downloading k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.3.2
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
go: downloading github.com/google/gnostic-models v0.7.1
go: downloading k8s.io/api v0.35.3
go: downloading github.com/fxamacker/cbor/v2 v2.9.1
go: downloading golang.org/x/term v0.41.0
go: downloading cloud.google.com/go/monitoring v1.24.3
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0
go: downloading github.com/kylelemons/godebug v1.1.0
go: downloading go.uber.org/zap v1.27.1
go: downloading github.com/coreos/go-semver v0.3.1
go: downloading github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506
go: downloading github.com/getsentry/sentry-go v0.44.1
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/cockroachdb/swiss v0.0.0-20251224182025-b0f6560f979b
go: downloading github.com/RaduBerinde/axisds v0.1.0
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/prometheus/client_model v0.6.2
go: downloading github.com/prometheus/common v0.67.5
go: downloading github.com/prometheus/procfs v0.20.1
go: downloading github.com/lestrrat-go/dsig v1.0.0
go: downloading github.com/lestrrat-go/dsig-secp256k1 v1.0.0
go: downloading github.com/valyala/fastjson v1.6.10
go: downloading github.com/cenkalti/backoff/v5 v5.0.3
go: downloading github.com/stretchr/objx v0.5.3
go: downloading go.yaml.in/yaml/v2 v2.4.4
go: downloading sigs.k8s.io/yaml v1.6.0
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.14
go: downloading golang.org/x/telemetry v0.0.0-20260316223853-b6b0c46d1ccd
go: downloading github.com/zeebo/xxh3 v1.1.0
go: downloading github.com/envoyproxy/go-control-plane/envoy v1.37.0
go: downloading github.com/golang/protobuf v1.5.4
go: downloading github.com/opentracing/opentracing-go v1.2.0
go: downloading github.com/PeerDB-io/tikv-client-go/v2 v2.0.7
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/RaduBerinde/btreemap v0.0.0-20260105202824-d3184786f603
go: downloading github.com/DataDog/zstd v1.5.7
go: downloading github.com/minio/minlz v1.1.0
go: downloading github.com/go-openapi/swag v0.25.5
go: downloading github.com/go-openapi/jsonreference v0.21.5
go: downloading gopkg.in/evanphx/json-patch.v4 v4.13.0
go: downloading github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2
go: downloading github.com/envoyproxy/protoc-gen-validate v1.3.3
go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
go: downloading github.com/spiffe/go-spiffe/v2 v2.6.0
go: downloading github.com/pingcap/sysutil v1.0.1-0.20240311050922-ae81ee01f3a5
go: downloading github.com/shirou/gopsutil/v3 v3.24.5
go: downloading github.com/opentracing/basictracer-go v1.1.0
go: downloading github.com/pingcap/kvproto v0.0.0-20260331120830-0d407c8b3f6e
go: downloading github.com/tiancaiamao/gp v0.0.0-20230126082955-4f9e4f1ed9b5
go: downloading github.com/tikv/pd/client v0.0.0-20251229071808-6173d50c004c
go: downloading go.etcd.io/etcd/api/v3 v3.6.9
go: downloading go.etcd.io/etcd/client/v3 v3.6.9
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/rogpeppe/go-internal v1.14.1
go: downloading github.com/emicklei/go-restful/v3 v3.13.0
go: downloading github.com/go-openapi/swag/cmdutils v0.25.5
go: downloading github.com/go-openapi/swag/conv v0.25.5
go: downloading github.com/go-openapi/swag/fileutils v0.25.5
go: downloading github.com/go-openapi/swag/jsonname v0.25.5
go: downloading github.com/go-openapi/swag/jsonutils v0.25.5
go: downloading github.com/go-openapi/swag/loading v0.25.5
go: downloading github.com/go-openapi/swag/mangling v0.25.5
go: downloading github.com/go-openapi/swag/netutils v0.25.5
go: downloading github.com/go-openapi/swag/stringutils v0.25.5
go: downloading github.com/go-openapi/swag/typeutils v0.25.5
go: downloading github.com/go-openapi/swag/yamlutils v0.25.5
go: downloading github.com/go-openapi/jsonpointer v0.22.5
go: downloading github.com/go-jose/go-jose/v4 v4.1.4
go: downloading cel.dev/expr v0.25.1
go: downloading github.com/lufia/plan9stats v0.0.0-20260330125221-c963978e514e
go: downloading github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55
go: downloading github.com/tklauser/go-sysconf v0.3.16
go: downloading github.com/cznic/mathutil v0.0.0-20181122101859-297441e03548
go: downloading github.com/twmb/murmur3 v1.1.8
go: downloading github.com/google/btree v1.1.3
go: downloading github.com/VividCortex/ewma v1.2.0
go: downloading github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da
go: downloading github.com/docker/go-units v0.5.0
go: downloading github.com/cloudfoundry/gosigar v1.3.117
go: downloading go.etcd.io/etcd/client/pkg/v3 v3.6.9
go: downloading github.com/shoenig/go-m1cpu v0.2.1
go: downloading github.com/yusufpapurcu/wmi v1.2.4
go: downloading github.com/tklauser/numcpus v0.11.0
go: downloading github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec
go: downloading github.com/coreos/go-systemd/v22 v22.7.0
go: downloading github.com/go-ole/go-ole v1.3.0
go: downloading github.com/PeerDB-io/peerdb v0.36.18
go: github.com/PeerDB-io/peerdb/flow/activities imports
	github.com/PeerDB-io/peerdb/flow/generated/protos: cannot find module providing package github.com/PeerDB-io/peerdb/flow/generated/protos
go: github.com/PeerDB-io/peerdb/flow/cmd imports
	github.com/PeerDB-io/peerdb/flow/generated/grpc_handler: cannot find module providing package github.com/PeerDB-io/peerdb/flow/generated/grpc_handler
go: github.com/PeerDB-io/peerdb/flow/cmd imports
	github.com/PeerDB-io/peerdb/flow/generated/proto_conversions: cannot find module providing package github.com/PeerDB-io/peerdb/flow/generated/proto_conversions
go: module github.com/aws/aws-sdk-go-v2/feature/s3/manager is deprecated: superceded by feature/s3/transfermanager. See https://github.com/aws/aws-sdk-go-v2/discussions/3306

codecov · 2026-04-23T23:39:53Z

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

github-actions · 2026-04-23T23:47:52Z

❌ Test Failure

Analysis: Deterministic build failure: Renovate's dependency update for go-jose/go-jose/v4 left a missing go.sum entry required by github.com/spiffe/go-spiffe/v2, causing the build to fail with exit code 1 before any tests ran.
Confidence: 0.97