Skip to content

chore(deps): address Dependabot vulnerabilities #425

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
freshtonic wants to merge 4 commits into
base: main
Choose a base branch
from
Open

chore(deps): address Dependabot vulnerabilities #425

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6a2db82
chore(deps): bump golang.org/x/crypto in /tests/integration/golang
dependabot[bot] Jul 10, 2026
75a66e1
chore(deps): address remaining Dependabot alerts
freshtonic Jul 22, 2026
5391b63
fix(auth): complete jsonwebtoken 10 migration
freshtonic Jul 22, 2026
b0c1cac
fix(ci): use Go 1.25 for integration tests
freshtonic Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
348 changes: 245 additions & 103 deletions Cargo.lock
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion tests/integration/golang/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM golang:1.24
FROM golang:1.25

WORKDIR /usr/src/app

Expand Down
10 changes: 5 additions & 5 deletions tests/integration/golang/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
module github.com/cipherstash/proxy/tests/tasks/test/integration/golang

go 1.24.0
go 1.25.0

require (
github.com/jackc/pgx/v5 v5.7.2
github.com/stretchr/testify v1.8.1
github.com/jackc/pgx/v5 v5.9.2
github.com/stretchr/testify v1.11.1
)

require (
Expand All @@ -14,7 +14,7 @@ require (
github.com/kr/text v0.2.0 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/rogpeppe/go-internal v1.13.1 // indirect
golang.org/x/crypto v0.45.0 // indirect
golang.org/x/text v0.31.0 // indirect
golang.org/x/crypto v0.52.0 // indirect
golang.org/x/text v0.37.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)
16 changes: 10 additions & 6 deletions tests/integration/golang/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7Ulw
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
github.com/jackc/pgx/v5 v5.7.2 h1:mLoDLV6sonKlvjIEsV56SkWNCnuNv531l94GaIzO+XI=
github.com/jackc/pgx/v5 v5.7.2/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
Expand All @@ -27,12 +29,14 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
Expand Down
55 changes: 36 additions & 19 deletions tests/python/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions tests/python/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ requires-python = ">=3.12"

dependencies = [
"psycopg (>=3.2.3,<4.0.0)",
"pytest (>=8.3.4,<9.0.0)",
"pytest-asyncio (>=0.25.3,<0.26.0)",
"pytest (>=9.0.3,<10.0.0)",
"pytest-asyncio (>=1.0.0,<2.0.0)",
]

[build-system]
Expand Down
32 changes: 25 additions & 7 deletions vendor/stack-auth/Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion vendor/stack-auth/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,8 @@ version = "0.34.1-alpha.4"
default-features = false

[dependencies.jsonwebtoken]
version = "9.3.1"
version = "10.3.0"
features = ["aws_lc_rs"]

[dependencies.miette]
version = "7.5.0"
Expand Down
16 changes: 3 additions & 13 deletions vendor/stack-auth/src/service_token.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,22 +144,12 @@ impl ServiceToken {
/// NOTE: This does not verify the token signature or validate any claims,
/// it only decodes the claims if the token is a well-formed JWT.
fn try_decode(secret: &SecretToken) -> Result<DecodedClaims, String> {
use jsonwebtoken::{decode, decode_header, DecodingKey, Validation};
use std::collections::HashSet;
use jsonwebtoken::{dangerous::insecure_decode, decode_header};

let token_str = secret.as_str();
let header =
decode_header(token_str).map_err(|e| format!("failed to decode JWT header: {e}"))?;

let dummy_key = DecodingKey::from_secret(&[]);
let mut validation = Validation::new(header.alg);
validation.validate_exp = false;
validation.validate_aud = false;
validation.required_spec_claims = HashSet::new();
validation.insecure_disable_signature_validation();

decode_header(token_str).map_err(|e| format!("failed to decode JWT header: {e}"))?;
let data: jsonwebtoken::TokenData<cts_common::claims::Claims> =
decode(token_str, &dummy_key, &validation)
insecure_decode(token_str)
.map_err(|e| format!("failed to decode JWT claims: {e}"))?;

let issuer: Url = data
Expand Down
15 changes: 3 additions & 12 deletions vendor/stack-auth/src/token.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,21 +169,12 @@ impl Token {
/// This is safe because we already possess the token — we just need to read
/// the claims it contains.
fn decode_claims(&self) -> Result<Claims, AuthError> {
use jsonwebtoken::{decode, decode_header, DecodingKey, Validation};
use std::collections::HashSet;
use jsonwebtoken::{dangerous::insecure_decode, decode_header};

let token_str = self.access_token.as_str();
let header = decode_header(token_str)
decode_header(token_str)
.map_err(|e| AuthError::InvalidToken(format!("invalid JWT header: {e}")))?;

let dummy_key = DecodingKey::from_secret(&[]);
let mut validation = Validation::new(header.alg);
validation.validate_exp = false;
validation.validate_aud = false;
validation.required_spec_claims = HashSet::new();
validation.insecure_disable_signature_validation();

decode(token_str, &dummy_key, &validation)
insecure_decode(token_str)
.map(|data| data.claims)
.map_err(|e| AuthError::InvalidToken(format!("failed to decode JWT claims: {e}")))
}
Expand Down
Loading