Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Jun 5, 2025

Bumps github.com/go-logr/logr from 1.2.3 to 1.4.3.

Release notes

Sourced from github.com/go-logr/logr's releases.

v1.4.3

Minor release.

What's Changed

New Contributors

Full Changelog: go-logr/logr@v1.4.2...v1.4.3

v1.4.2

What's Changed

Dependencies:

... (truncated)

Commits
  • 38a1c47 build(deps): bump github/codeql-action from 3.28.17 to 3.28.18
  • f08bedd build(deps): bump actions/setup-go from 5.4.0 to 5.5.0
  • 6295e99 build(deps): bump golangci/golangci-lint-action from 7.0.0 to 8.0.0
  • 028840d build(deps): bump github/codeql-action from 3.28.15 to 3.28.17
  • 511e5fa Merge pull request #367 from go-logr/dependabot/github_actions/github/codeql-...
  • d806463 build(deps): bump github/codeql-action from 3.28.13 to 3.28.15
  • 158c311 Merge pull request #366 from thockin/master
  • c79ddb3 Update to support golangci-lint v2
  • 20a64ba build(deps): bump github/codeql-action from 3.28.12 to 3.28.13
  • 0385e14 Add comments around slog exceptions
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by Bito

This PR updates the github.com/go-logr/logr dependency from version 1.2.3 to 1.4.3. The update incorporates minor improvements and fixes from newer releases, ensuring the project maintains current and compatible dependencies. This change focuses solely on dependency hygiene.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [github.com/go-logr/logr](https://github.com/go-logr/logr) from 1.2.3 to 1.4.3.
- [Release notes](https://github.com/go-logr/logr/releases)
- [Changelog](https://github.com/go-logr/logr/blob/master/CHANGELOG.md)
- [Commits](go-logr/logr@v1.2.3...v1.4.3)

---
updated-dependencies:
- dependency-name: github.com/go-logr/logr
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 5, 2025
@bito-code-review
Copy link

bito-code-review bot commented Jun 5, 2025

Code Review Agent Run #09b488

Actionable Suggestions - 0
Security Concerns - 10
  • Vulnerability 1
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2024-2687
    • Vulnerability Description: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending excessive CONTINUATION frames, leading to potential DoS.
    • Fixed in Version: v0.23.0
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - golang.org/x/net v0.22.0
      + golang.org/x/net v0.23.0
      
  • Vulnerability 2
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2024-3333
    • Vulnerability Description: An attacker can craft input to Parse functions that would be processed non-linearly, causing extremely slow parsing and potential DoS.
    • Fixed in Version: v0.33.0
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - golang.org/x/net v0.23.0
      + golang.org/x/net v0.33.0
      
  • Vulnerability 3
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3503
    • Vulnerability Description: IPv6 zone ID can be improperly treated as hostname component, causing incorrect proxy pattern matching.
    • Fixed in Version: v0.36.0
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - golang.org/x/net v0.33.0
      + golang.org/x/net v0.36.0
      
  • Vulnerability 4
    • Dependency Name: golang.org/x/net
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3595
    • Vulnerability Description: HTML tokenizer incorrectly interprets tags with unquoted attribute values ending with solidus character as self-closing.
    • Fixed in Version: v0.38.0
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - golang.org/x/net v0.36.0
      + golang.org/x/net v0.38.0
      
  • Vulnerability 5
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3373
    • Vulnerability Description: Certificate with URI containing IPv6 address with zone ID may incorrectly satisfy URI name constraint in certificate chain.
    • Fixed in Version: v1.23.5
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - go 1.23.4
      + go 1.23.5
      
  • Vulnerability 6
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3420
    • Vulnerability Description: HTTP client incorrectly restores sensitive headers after cross-domain redirects in certain scenarios.
    • Fixed in Version: v1.23.5
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - go 1.23.4
      + go 1.23.5
      
  • Vulnerability 7
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3447
    • Vulnerability Description: Variable time instruction in assembly implementation leaks bits of secret scalars on ppc64le architecture.
    • Fixed in Version: v1.23.6
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - go 1.23.5
      + go 1.23.6
      
  • Vulnerability 8
    • Dependency Name: stdlib
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3563
    • Vulnerability Description: net/http package improperly accepts bare LF as line terminator in chunked data, enabling request smuggling.
    • Fixed in Version: v1.23.8
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - go 1.23.6
      + go 1.23.8
      
  • Vulnerability 9
    • Dependency Name: google.golang.org/protobuf
    • Dependency Version: None
    • Vulnerability Name: GO-2024-2611
    • Vulnerability Description: protojson.Unmarshal can enter infinite loop when unmarshaling certain invalid JSON forms.
    • Fixed in Version: v1.33.0
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - google.golang.org/protobuf v1.32.0
      + google.golang.org/protobuf v1.33.0
      
  • Vulnerability 10
    • Dependency Name: golang.org/x/oauth2
    • Dependency Version: None
    • Vulnerability Name: GO-2025-3488
    • Vulnerability Description: Malformed token can cause unexpected memory consumption during parsing.
    • Fixed in Version: v0.27.0
    • Code Suggestion:
      
      @@ -1,1 +1,1 @@
      - golang.org/x/oauth2 v0.26.0
      + golang.org/x/oauth2 v0.27.0
      
Review Details
  • Files reviewed - 1 · Commit Range: a830ddf..a830ddf
    • go.mod
  • Files skipped - 1
    • go.sum - Reason: Filter setting
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • GOVULNCHECK (Security Vulnerability) - ✔︎ Successful
    • OWASP (Security Vulnerability) - ✔︎ Successful
    • SNYK (Security Vulnerability) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at [email protected].

Documentation & Help

AI Code Review powered by Bito Logo

@bito-code-review
Copy link

Changelist by Bito

This pull request implements the following key changes.

Key Change Files Impacted
Other Improvements - Dependency Version Bump

go.mod - Updated github.com/go-logr/logr from version 1.2.3 to 1.4.3.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants