Skip to content

Commit 761d870

Browse files
i-m-addycoderi-m-addycoder
authored
chore(security): upgrade dependency versions (#1632)
<!-- Please use this template for your pull request. --> <!-- Please use the sections that you need and delete other sections --> ## This PR <!-- add the description of the PR here --> - upgrades 2 dependency versions to fix CVEs ### Notes <!-- any additional notes for this PR --> Dependency upgrades and corresponding CVEs - github.com/golang-jwt/jwt/v5 | v5.2.1 - https://www.cve.org/CVERecord?id=CVE-2025-30204 - `go get github.com/golang-jwt/jwt/[email protected]` in core, flagd and flagd-proxy directories - golang.org/x/oauth2/jws | v0.25.0 and v0.26.0 - https://www.cve.org/CVERecord?id=CVE-2025-22868 - `go get golang.org/x/[email protected]` in core, flagd and flagd-proxy directories ### How to test <!-- if applicable, add testing instructions under this section --> 1. `make workspace-init` 2. `make test` Signed-off-by: Aditya Thakur <[email protected]>
1 parent 7566f51 commit 761d870

File tree

6 files changed

+24
-12
lines changed

6 files changed

+24
-12
lines changed

‎core/go.mod‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
module github.com/open-feature/flagd/core
22

3-
go 1.22.7
3+
go 1.23.0
44

5-
toolchain go1.24.1
5+
toolchain go1.24.2
66

77
require (
88
buf.build/gen/go/open-feature/flagd/grpc/go v1.5.1-20250127221518-be6d1143b690.2
@@ -92,7 +92,7 @@ require (
9292
github.com/go-openapi/jsonreference v0.21.0 // indirect
9393
github.com/go-openapi/swag v0.23.0 // indirect
9494
github.com/gogo/protobuf v1.3.2 // indirect
95-
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
95+
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
9696
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
9797
github.com/golang/protobuf v1.5.4 // indirect
9898
github.com/google/gnostic-models v0.6.8 // indirect
@@ -131,7 +131,7 @@ require (
131131
go.opentelemetry.io/proto/otlp v1.5.0 // indirect
132132
go.uber.org/multierr v1.11.0 // indirect
133133
golang.org/x/net v0.35.0 // indirect
134-
golang.org/x/oauth2 v0.26.0 // indirect
134+
golang.org/x/oauth2 v0.27.0 // indirect
135135
golang.org/x/sys v0.30.0 // indirect
136136
golang.org/x/term v0.29.0 // indirect
137137
golang.org/x/text v0.22.0 // indirect

‎core/go.sum‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,8 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
138138
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
139139
github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
140140
github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
141+
github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
142+
github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
141143
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
142144
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
143145
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
@@ -406,6 +408,8 @@ golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
406408
golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
407409
golang.org/x/oauth2 v0.26.0 h1:afQXWNNaeC4nvZ0Ed9XvCCzXM6UHJG7iCg0W4fPqSBE=
408410
golang.org/x/oauth2 v0.26.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
411+
golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
412+
golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
409413
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
410414
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
411415
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

‎flagd-proxy/go.mod‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
module github.com/open-feature/flagd/flagd-proxy
22

3-
go 1.22.7
3+
go 1.23.0
44

5-
toolchain go1.24.1
5+
toolchain go1.24.2
66

77
require (
88
buf.build/gen/go/open-feature/flagd/grpc/go v1.5.1-20250127221518-be6d1143b690.2
@@ -72,7 +72,7 @@ require (
7272
github.com/go-openapi/jsonreference v0.21.0 // indirect
7373
github.com/go-openapi/swag v0.23.0 // indirect
7474
github.com/gogo/protobuf v1.3.2 // indirect
75-
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
75+
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
7676
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
7777
github.com/golang/protobuf v1.5.4 // indirect
7878
github.com/google/gnostic-models v0.6.8 // indirect
@@ -129,7 +129,7 @@ require (
129129
gocloud.dev v0.40.0 // indirect
130130
golang.org/x/crypto v0.33.0 // indirect
131131
golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac // indirect
132-
golang.org/x/oauth2 v0.25.0 // indirect
132+
golang.org/x/oauth2 v0.27.0 // indirect
133133
golang.org/x/sys v0.30.0 // indirect
134134
golang.org/x/term v0.29.0 // indirect
135135
golang.org/x/text v0.22.0 // indirect

‎flagd-proxy/go.sum‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,8 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
135135
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
136136
github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
137137
github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
138+
github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
139+
github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
138140
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
139141
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
140142
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
@@ -420,6 +422,8 @@ golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
420422
golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
421423
golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
422424
golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
425+
golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
426+
golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
423427
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
424428
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
425429
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

‎flagd/go.mod‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
module github.com/open-feature/flagd/flagd
22

3-
go 1.22.7
3+
go 1.23.0
44

5-
toolchain go1.24.1
5+
toolchain go1.24.2
66

77
require (
88
buf.build/gen/go/open-feature/flagd/connectrpc/go v1.18.1-20250127221518-be6d1143b690.1
@@ -86,7 +86,7 @@ require (
8686
github.com/go-openapi/jsonreference v0.21.0 // indirect
8787
github.com/go-openapi/swag v0.23.0 // indirect
8888
github.com/gogo/protobuf v1.3.2 // indirect
89-
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
89+
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
9090
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
9191
github.com/golang/protobuf v1.5.4 // indirect
9292
github.com/google/gnostic-models v0.6.8 // indirect
@@ -152,7 +152,7 @@ require (
152152
golang.org/x/crypto v0.33.0 // indirect
153153
golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac // indirect
154154
golang.org/x/mod v0.23.0 // indirect
155-
golang.org/x/oauth2 v0.25.0 // indirect
155+
golang.org/x/oauth2 v0.27.0 // indirect
156156
golang.org/x/sys v0.30.0 // indirect
157157
golang.org/x/term v0.29.0 // indirect
158158
golang.org/x/text v0.22.0 // indirect

‎flagd/go.sum‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,8 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
141141
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
142142
github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
143143
github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
144+
github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
145+
github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
144146
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
145147
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
146148
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
@@ -407,6 +409,8 @@ golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
407409
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
408410
golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
409411
golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
412+
golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
413+
golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
410414
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
411415
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
412416
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

0 commit comments

Comments
 (0)