NOJIRA-Fix-dependabot-go-security-alerts - #1145
Merged
Merged
Conversation
Bumps golang.org/x/crypto, golang.org/x/net, filippo.io/edwards25519, google.golang.org/grpc, go.opentelemetry.io/otel(/sdk), kin-openapi, oapi-codegen, go-jose, quic-go, chi, and aws-sdk-go-v2 across all 35 affected Go services to their patched versions, and bumps aiohttp, idna, nltk, pillow, pyasn1, pygments, python-dotenv, requests, setuptools, starlette, fastapi, torch, transformers, and urllib3 in bin-pipecat-manager's uv.lock. Resolves the large majority of open GitHub Dependabot security alerts (critical/high auth-bypass, DoS, and RCE issues in x/crypto and Pillow in particular). All 35 affected Go modules build cleanly and the pip lockfile resolves consistently after the bump; no source code changes were required. - bin-agent-manager: bump golang.org/x/crypto, x/net, edwards25519 - bin-ai-manager: bump x/crypto, x/net, edwards25519, grpc, otel - bin-api-manager: bump x/crypto, x/net, edwards25519, grpc, otel, kin-openapi, oapi-codegen, go-jose, quic-go - bin-billing-manager: bump x/crypto, x/net, edwards25519 - bin-call-manager: bump x/crypto, x/net, edwards25519 - bin-campaign-manager: bump x/crypto, x/net, edwards25519 - bin-common-handler: bump x/crypto, x/net, edwards25519 - bin-conference-manager: bump x/crypto, x/net, edwards25519 - bin-contact-manager: bump x/crypto, x/net, edwards25519 - bin-conversation-manager: bump x/crypto, x/net, edwards25519 - bin-customer-manager: bump x/crypto, x/net, edwards25519 - bin-direct-manager: bump x/crypto, x/net, edwards25519 - bin-email-manager: bump x/crypto, x/net, edwards25519, chi - bin-flow-manager: bump x/crypto, x/net, edwards25519 - bin-hook-manager: bump x/crypto, x/net, edwards25519, quic-go - bin-message-manager: bump x/crypto, x/net, edwards25519 - bin-number-manager: bump x/crypto, x/net, edwards25519 - bin-openapi-manager: bump kin-openapi - bin-outdial-manager: bump x/crypto, x/net, edwards25519 - bin-pipecat-manager: bump x/crypto, x/net, edwards25519, quic-go, and pip deps (aiohttp, idna, nltk, pillow, pyasn1, pygments, python-dotenv, requests, setuptools, starlette, fastapi, torch, transformers, urllib3) - bin-queue-manager: bump x/crypto, x/net, edwards25519 - bin-rag-manager: bump x/crypto, x/net, edwards25519, grpc, otel, go-jose - bin-registrar-manager: bump x/crypto, x/net, edwards25519 - bin-route-manager: bump x/crypto, x/net, edwards25519 - bin-sentinel-manager: bump x/crypto, x/net, edwards25519 - bin-storage-manager: bump x/crypto, x/net, edwards25519, grpc, otel, go-jose - bin-tag-manager: bump x/crypto, x/net, edwards25519 - bin-talk-manager: bump x/crypto, x/net, edwards25519 - bin-timeline-manager: bump x/crypto, x/net, edwards25519, grpc, otel, go-jose - bin-transcribe-manager: bump x/crypto, x/net, edwards25519, grpc, otel, aws-sdk-go-v2 - bin-transfer-manager: bump x/crypto, x/net, edwards25519 - bin-tts-manager: bump x/crypto, x/net, edwards25519, grpc, otel - bin-webchat-manager: bump x/crypto, x/net, edwards25519 - bin-webhook-manager: bump x/crypto, x/net, edwards25519 - voip-asterisk-proxy: bump x/crypto, x/net, edwards25519, grpc, otel, go-jose - voip-rtpengine-proxy: bump x/crypto, x/net, grpc, otel, go-jose
The initial go get for the 9 services below failed atomically (grpc and otel/sdk required otel core at a different version than first requested), so grpc, otel/sdk, kin-openapi, oapi-codegen, and go-jose were silently left at their pre-bump vulnerable versions even though the otel core package alone was fixed up separately afterward. Re-applies the full target package set together per service and re-verifies with go build. - bin-ai-manager: bump grpc to v1.82.1 - bin-api-manager: bump grpc, otel/sdk, kin-openapi (critical auth bypass fix), oapi-codegen, go-jose - bin-rag-manager: bump grpc, otel/sdk, go-jose - bin-storage-manager: bump grpc, otel/sdk, go-jose - bin-timeline-manager: bump grpc, otel/sdk, go-jose - bin-transcribe-manager: bump grpc, aws-sdk-go-v2 eventstream/transcribestreaming - bin-tts-manager: bump grpc - voip-asterisk-proxy: bump grpc, otel/sdk, go-jose - voip-rtpengine-proxy: bump grpc, otel/sdk, go-jose
pchero
force-pushed
the
NOJIRA-Fix-dependabot-go-security-alerts
branch
from
July 29, 2026 22:20
8981603 to
68d2aa8
Compare
pchero
added a commit
that referenced
this pull request
Jul 30, 2026
- bin-openapi-manager: Add .github/dependabot.yml ignoring the oapi-codegen dependency so future Dependabot version/security updates cannot re-drift go.mod away from the version that generated the committed gens/models/gen.go, which is what caused this PR's underlying CI failure (introduced by #1145's automated dependency sweep).
pchero
added a commit
that referenced
this pull request
Jul 30, 2026
Fix a version mismatch between go.mod and the committed generated models in bin-openapi-manager that was causing the CircleCI "Verify generated models match committed" check to fail, and prevent the same class of drift from recurring via automated dependency updates. - bin-openapi-manager: Bump oapi-codegen from v2.7.1 to v2.8.0 in go.mod/go.sum. go.mod was pinned to v2.7.1 while the committed gens/models/gen.go was actually generated with v2.8.0 (v2.8.0 keeps the type-name-prefixed enum constants, e.g. PutAisIdJSONBodyTypeInsight, that the rest of the codebase already references, and includes the // Example: doc comments). Running go generate ./... with the old pin regenerated with v2.7.1 instead, stripping the Example comments and renaming enum constants to unprefixed form, which would have broken every consumer service referencing the prefixed names. - bin-openapi-manager: Add .github/dependabot.yml ignoring the oapi-codegen dependency for this service, since a prior dependency sweep (#1145) silently downgraded oapi-codegen to v2.7.1 as a side effect of an unrelated go mod tidy, without regenerating gens/models/gen.go. This scopes an ignore rule to prevent a future automated bump from reintroducing the same drift.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps vulnerable Go and Python dependencies flagged by GitHub Dependabot to their
patched versions across the monorepo. golang.org/x/crypto alone accounted for over
70% of the 718 open alerts (all 35 Go services pinned the same vulnerable v0.49.0);
bumping the handful of shared packages below resolves the large majority of open
alerts, including multiple critical auth-bypass and RCE issues. No source code
changes were required; all 35 affected Go modules build cleanly (go build ./...)
and the pip lockfile resolves consistently after the bump.