[ValgulNecron]

Summary

Master currently fails two checks, and this PR fixes both.

1. vuln (images): go-jose v4.1.4 in frpc

The only finding comes from the tunnel-frp image:

usr/local/bin/frpc (gobinary)
github.com/go-jose/go-jose/v4 │ CVE-2026-116587 │ HIGH │ fixed │ v4.1.4 │ 4.1.6 │ Go JOSE: DoS when parsing JWKs that contain RSA keys
✗ fixed HIGH/CRITICAL vulnerabilities (or a scan error) in 1 of 12 scan(s): gameplane-test/tunnel-frp:e2e

Source: master run 40869672773 (b07e4d4). PR #768 fails with the same lines. The other 11 images scan clean.

tunnel/Dockerfile.frp builds frpc from tunnel/frpc/go.mod, and that file still pinned go-jose v4.1.4. #811 bumped only the operator, and api and operator were already on v4.1.6.

• tunnel/frpc/go.mod: github.com/go-jose/go-jose/v4 goes from v4.1.4 to v4.1.6.
• tunnel/frpc/go.sum: adds the v4.1.6 hashes and drops the v4.1.4 ones. go mod tidy can't run on this module because it has no .go files, so tidy would empty the require block.

2. lint (operator): staticcheck SA1019

operator/internal/controller/restore_lifecycle.go:296:25: SA1019: (sigs.k8s.io/controller-runtime.Result).Requeue is deprecated: Use `RequeueAfter` instead. (staticcheck)

This line was red on master from the moment #760 merged (7affd86). The fix replaces ctrl.Result{Requeue: true} with ctrl.Result{RequeueAfter: time.Nanosecond}, the same form the matching progressed branch in restore_controller.go:199-200 already uses.

Verification

• frpc built locally exactly as the Dockerfile builds it (GOFLAGS=-mod=readonly go build -tags frpc,noweb github.com/fatedier/frp/cmd/frpc). go version -m shows dep github.com/go-jose/go-jose/v4 v4.1.6.
• go build ./... and go vet ./internal/controller/ pass in operator/.
• CI makes the final call.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 12 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: fix/go-jose-4.1.6
• File: .coderabbit.yaml
• Commit: 906f4d7
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0b7b94bb-0f93-416d-b786-2e5233ff5088

Commits

Reviewing files that changed from the base of the PR and between b07e4d4 and 906f4d7.

Files ignored due to path filters: 1

• tunnel/frpc/go.sum is excluded by !**/*.sum

Files selected for processing: 2

• operator/internal/controller/restore_lifecycle.go
• tunnel/frpc/go.mod

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ValgulNecron]

lint (operator) fails here, but the cause isn't this PR. This PR changes only tunnel/frpc/go.mod and go.sum.

The error matches master's run 40869672773 line for line:

operator/internal/controller/restore_lifecycle.go:296:25: SA1019: (sigs.k8s.io/controller-runtime.Result).Requeue is deprecated: Use `RequeueAfter` instead. (staticcheck)

It came in with 7affd86 (merged in #760). No open PR fixes it yet. The proposed fix matches the pattern restore_controller.go:199-200 already uses:

-	return ctrl.Result{Requeue: true}, nil
+	return ctrl.Result{RequeueAfter: time.Nanosecond}, nil

I haven't applied it because it's a production code change outside this PR's scope, so it waits on the maintainer's call.

---

Generated by Claude Code

[github-actions]

CI Report - 906f4d7

run 40973833978 - attempt 2

0 failed - 24 passed - 9 skipped - unknown elapsed

Test selection: partial - per-suite table

Coverage

no coverage/* commit statuses found on 906f4d7

Changed

Area	Files	+/-
tunnel/	2	+3/-3
operator/	1	+1/-1

Slowest jobs

no job duration data available

e2e buckets run

bot-fast