Bump mapstructure version

[mitar]

Version

0.13.4

Go Version

1.25

Description

nancy just started complaining about this security issue:

GHSA-2464-8j7c-4cjm

It looks like this package depends on an old mapstructure library. Maybe it is time to bump it to version 2.4.0?

Reproduction

Run nancy.

Expectations

No response

Documentation

No response

[mitar]

I made #522 to address this.

[james-d-elliott]

This is a false positive in nancy. None of the information handled by mapstructure is even slightly sensitive, and anything that would be potentially sensitive that is handled by this library is either a random challenge or public key making it inconsequential. In addition the decode funcs that use strconv are the vulnerable ones, which are not used since we don't use weak decoding and don't explicitly list them (CodeQL correctly detects this too).

[mitar]

I agree. This aligns with my investigation as well. But I think that moving away from unmaintained and archived dependency github.com/mitchellh/mapstructure is still a good move in any case.

[james-d-elliott]

Yeah that makes sense to me. Have you used the PR in prod with MDS3 yet?

[mitar]

No. I have not pushed yet this to prod.

But I also manually reviewed changes between versions and they look reasonable.