What is the process of security vulnerabilities, v3.6.5 has CVE-2025-29786 for github.com/expr-lang/expr:1.16.9 and CVE-2025-30204 for github.com/golang-jwt/jwt/v5:5.2.1

[pkmmann]

v3.6.5 has CVE-2025-29786 for github.com/expr-lang/expr:1.16.9
and CVE-2025-30204 for github.com/golang-jwt/jwt/v5:5.2.1

What is the process for security vulnerabilities resolution on Argo-workflow

[tczhao]

If it's a direct dependency, we will have dependentbot raise the PR and auto merge #14307
Looks like something failed, will fix it
for indirect dependency, we will have to wait for the parent package made the fix first.
Security fixes will get included in the next release

[pkmmann]

Thank you so much @tczhao appreciate your help.

Can you please help me check if we can upgrade github.com/golang-jwt/jwt/v5:5.2.1 to 5.2.2

[tczhao]

There was issue with dependabot, retried, able to create PR, will monitor and get it merge
#14353

[pkmmann]

thank you so much @tczhao