Release vault-plugin-secrets-ksm v1.0.5 - #691
Open
idimov-keeper wants to merge 15 commits into
Open
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
…olds (#1105) Clears 8 critical and 3 high Dependabot advisories, all runtime scope: golang.org/x/crypto v0.45.0 -> v0.53.0 (threshold v0.52.0) google.golang.org/grpc v1.77.0 -> v1.82.1 (threshold v1.82.1) golang.org/x/net v0.47.0 -> v0.55.0 (threshold v0.55.0) x/crypto resolves to v0.53.0 rather than v0.54.0 because x/net v0.55.0 pins it there; v0.53.0 is above the advisory threshold. The 4 remaining github.com/docker/docker advisories on this module have no patched version available and need an accepted-risk decision rather than a bump. go build and go vet pass; the module has no test files.
…lities go.mod declared 'go 1.25.0' with no toolchain directive and the publish workflow pinned setup-go to 1.21, so toolchain resolution landed on exactly go1.25.0 and could never pick up a patch release. govulncheck against the branch before this change: Your code is affected by 24 vulnerabilities from 1 module and the Go standard library. 22 of the 24 were reachable stdlib defects fixed between go1.25.2 and go1.25.12, across crypto/tls, crypto/x509, net/http, net/url and encoding/asn1. Several trace through this plugin's own code rather than only the Vault SDK, for example ksm/client.go:68 reaching tls.Dialer.DialContext and ksm/client.go:67 reaching x509.MarshalPKCS8PrivateKey. After: 2 vulnerabilities, both github.com/docker/docker with no upstream fix available under that module path. Those two are reachable only through package init functions, not through calls into the affected logic. The workflow pin is set to match the toolchain directive so the two cannot drift apart silently. go build and go vet pass on go1.25.12; the module has no test files.
govulncheck ran in no workflow in this repo, despite being the only Go scanner that filters by reachability. It reports a vulnerability solely when the code can actually reach the affected symbol, so its output arrives triaged rather than needing a manual pass like a Dependabot manifest diff. It is what found the stale-toolchain defect fixed in 32482c6. Runs on pull requests touching the plugin, plus weekly on a schedule. The schedule matters more than the PR trigger: advisories are published against unchanged code, so a scan wired only to PRs goes quiet exactly when a new CVE lands. The Go version is pinned to match the toolchain directive in go.mod and the publish workflow, since stdlib findings reflect the toolchain doing the building and scanning a version we do not ship answers the wrong question. Results upload as SARIF to code scanning instead of failing the job. That fits this module specifically: two docker/docker advisories are reachable with no upstream fix available under that module path, so a hard failure would block the plugin permanently rather than prompting a decision. Dismissing an alert in code scanning records who accepted the risk and why, which is the audit trail a release review needs. Making it blocking is a branch protection setting rather than a change to this file. Verified: the jq summary expressions were checked against real SARIF output from this module, which reports 2 error-level results (GO-2026-4883, GO-2026-4887). actionlint and zizmor clean.
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KSM-577 Bump golang.org/x/crypto from 0.27.0 to 0.31.0