Skip to content

chore(deps): update module golang.org/x/oauth2 to v0.27.0 [security] (main)#818

Merged
jbw976 merged 2 commits intomainfrom
renovate/main-go-golang.org-x-oauth2-vulnerability
May 13, 2025
Merged

chore(deps): update module golang.org/x/oauth2 to v0.27.0 [security] (main)#818
jbw976 merged 2 commits intomainfrom
renovate/main-go-golang.org-x-oauth2-vulnerability

Conversation

@crossplane-renovate
Copy link
Copy Markdown
Contributor

@crossplane-renovate crossplane-renovate bot commented Mar 5, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
golang.org/x/oauth2 indirect minor v0.21.0 -> v0.27.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Unexpected memory consumption during token parsing in golang.org/x/oauth2

CVE-2025-22868 / GHSA-3wqc-mwfx-672p / GO-2025-3488

More information

Details

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@crossplane-renovate crossplane-renovate bot requested a review from a team as a code owner March 5, 2025 08:05
@crossplane-renovate crossplane-renovate bot requested a review from negz March 5, 2025 08:05
@crossplane-renovate
Copy link
Copy Markdown
Contributor Author

crossplane-renovate bot commented Mar 5, 2025

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.mod
Command failed: earthly --strict +go-generate
 Init 🚀
————————————————————————————————————————————————————————————————————————————————

           buildkitd | Found buildkit daemon as docker container (earthly-buildkitd)

 Build 🔧
————————————————————————————————————————————————————————————————————————————————

              logbus | Setting organization "crossplane" and project "crossplane-runtime"
        +go-generate | --> FROM +base
        +go-generate | --> FROM +go-modules
         +go-modules | --> FROM +base
       golang:1.22.3 | --> Load metadata golang:1.22.3 linux/amd64
Warning: you are not logged into registry-1.docker.io, you may experience rate-limitting when pulling images
         +go-modules | --> FROM golang:1.22.3
         +go-modules | [----------] 100% FROM golang:1.22.3�[K
         +go-modules | [          ]   0% FROM golang:1.22.3�[K
         +go-modules | �[A[----------] 100% FROM golang:1.22.3�[K
         +go-modules | --> WORKDIR /crossplane
         +go-modules | --> COPY go.mod go.sum ./
         +go-modules | --> RUN go mod download
         +go-modules | go: go.mod requires go >= 1.23.0 (running go 1.22.3; GOTOOLCHAIN=local)
         +go-modules | ERROR Earthfile:48:2
         +go-modules |       The command
         +go-modules |           RUN go mod download
         +go-modules |       did not complete successfully. Exit code 1

================================== ❌ FAILURE ===================================

         +go-modules *failed* | Repeating the failure error...
         +go-modules *failed* | --> RUN go mod download
         +go-modules *failed* | go: go.mod requires go >= 1.23.0 (running go 1.22.3; GOTOOLCHAIN=local)
         +go-modules *failed* | ERROR Earthfile:48:2
         +go-modules *failed* |       The command
         +go-modules *failed* |           RUN go mod download
         +go-modules *failed* |       did not complete successfully. Exit code 1

Help: To debug your build, you can use the --interactive (-i) flag to drop into a shell of the failing RUN step: "earthly -i --strict +go-generate"

🛰️ Reuse cache between CI runs with Earthly Satellites! 2-20X faster than without cache. Generous free tier https://cloud.earthly.dev

@jbw976
chore(lint): bump go/golangci-lint versions and fix all linter errors
8e6ab16 
This commit bumps the golang version to the same used currently in
core crossplane (1.23.7) and then uses the latest 1.x version of
golangci-lint. Previous versions of golangci-lint are tough to use
because of recvcheck not supporting exclusions until its v0.2.0 release.

This commit shares some similar fixes as seen in crossplane/crossplane#6111

Signed-off-by: Jared Watts <jbw976@gmail.com>
jbw976
jbw976 reviewed May 13, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@jbw976 jbw976 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I pushed commit 8e6ab16 to bump versions of golang/golangci-lint and fix all linter errors.

@jbw976 jbw976 merged commit e68a2c6 into main May 13, 2025
9 checks passed
@crossplane-renovate crossplane-renovate bot deleted the renovate/main-go-golang.org-x-oauth2-vulnerability branch May 13, 2025 17:57
@jbw976 jbw976 mentioned this pull request May 13, 2025
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jbw976 jbw976 jbw976 approved these changes

@phisco phisco phisco approved these changes

@negz negz Awaiting requested review from negz negz is a code owner automatically assigned from crossplane/crossplane-maintainers

Assignees

No one assigned

Labels

automated

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jbw976 @phisco