Skip to content

[TT-17446] Tyk Gateway 5.13.1/5.14.0 CVEs#8315

Merged
lghiur merged 6 commits into
masterfrom
TT-17446
Jun 22, 2026
Merged

[TT-17446] Tyk Gateway 5.13.1/5.14.0 CVEs#8315
lghiur merged 6 commits into
masterfrom
TT-17446

Conversation

@MFCaballero

@MFCaballero MFCaballero commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description

  • upgrade github.com/jackc/pgx/v5 to v5.9.2
  • upgrade golang.org/x/crypto to v0.52.0
  • upgrade golang.org/x/net to v0.55.0
  • upgrade golang.org/x/image to v0.41.0
  • upgrade golang.org/x/sys to v0.46.0 (minimum required by downgraded golang.org/x/crypto v0.52.0 and downgraded golang.org/x/net v0.55.0)

Related Issue

Motivation and Context

How This Has Been Tested

Screenshots (if appropriate)

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Refactoring or add test (improvements in base code or adds test coverage to functionality)

Checklist

  • I ensured that the documentation is up to date
  • I explained why this PR updates go.mod in detail with reasoning why it's required
  • I would like a code coverage CI quality gate exception and have explained why

@probelabs

probelabs Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This pull request addresses security vulnerabilities (CVEs) by updating several core Go dependencies. The changes are confined to go.mod and go.sum, reflecting a targeted effort to patch security issues without altering application logic.

Files Changed Analysis

  • go.mod: Modified to specify new versions for five dependencies.
  • go.sum: Updated with the checksums for the new dependency versions and their transitive dependencies.

The changes are consistent and minimal, with 11 lines added and 11 deleted in go.mod, and corresponding checksum updates in go.sum. This pattern is typical for routine dependency maintenance.

Architecture & Impact Assessment

  • What this PR accomplishes: This PR mitigates security risks by upgrading dependencies with known vulnerabilities. It's a maintenance task crucial for the security posture of the Tyk Gateway.

  • Key technical changes introduced: The versions of the following dependencies have been upgraded:

    • github.com/jackc/pgx/v5: v5.9.1 -> v5.9.2
    • golang.org/x/crypto: v0.49.0 -> v0.52.0
    • golang.org/x/net: v0.52.0 -> v0.55.0
    • golang.org/x/image: v0.39.0 -> v0.41.0
    • golang.org/x/sys: v0.42.0 -> v0.46.0

  • Affected system components: The upgraded packages are fundamental and have a broad impact across the gateway:

    • github.com/jackc/pgx/v5: This library is the PostgreSQL driver. Any component interacting with a PostgreSQL database for configuration, analytics, or session management is affected.
    • golang.org/x/crypto: This is a critical dependency for all cryptographic operations, including TLS, hashing, and data encryption. Its impact is system-wide.
    • golang.org/x/net, golang.org/x/sys: These packages provide low-level networking and operating system primitives. They are used extensively throughout the application for handling HTTP traffic, system signals, and other core functionalities.

The primary risk associated with this PR is the potential for regressions or subtle behavioral changes introduced by the new library versions. A thorough review of the CI test suite results is essential to ensure that these upgrades do not negatively impact gateway functionality.

Scope Discovery & Context Expansion

The scope of this change is strictly dependency management. However, the impact is system-wide due to the foundational nature of the updated packages.

A key piece of missing context, as noted in the PR comments, is the list of specific CVEs being addressed by these upgrades. For a complete and effective review, this information is critical to:

  1. Confirm that the version bumps are necessary.
  2. Verify that the chosen versions effectively remediate the target vulnerabilities.
  3. Understand the security implications if the PR were to be delayed or rejected.

Without the CVE identifiers, reviewers must rely solely on the passing test suite to approve the change, which may not cover all edge cases introduced by the dependency updates. It is highly recommended to update the PR description with the relevant CVEs.

Metadata
  • Review Effort: 2 / 5
  • Primary Label: n/a

Powered by Visor from Probelabs

Last updated: 2026-06-19T16:04:29.178Z | Triggered by: pr_updated | Commit: e32a548

💡 TIP: You can chat with Visor using /visor ask <your question>

@github-actions

github-actions Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🎯 Recommended Merge Targets

Based on JIRA ticket TT-17446: Tyk Gateway 5.13.1/5.14.0 CVEs

Fix Version: Tyk 5.13.1

Required:

  • release-5.13.1 - Exact version branch for Tyk 5.13.1 - specific patch release
  • release-5.13 - Minor version branch for 5.13.x patches - required for creating Tyk 5.13.1
  • master - Main development branch - ensures fix is in all future releases

Fix Version: Tyk 5.14.0

⚠️ Warning: Expected release branches not found in repository

Required:

  • master - No matching release branches found. Fix will be included in future releases.

📋 Workflow

  1. Merge this PR to master first

  2. Cherry-pick to release branches by commenting on the merged PR:

    • /release to release-5.13.1
    • /release to release-5.13

  3. Automated backport - The bot will automatically create backport PRs to the specified release branches

@probelabs

probelabs Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

\n\n

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

\n\n

✅ Performance Check Passed

No performance issues found – changes LGTM.

Quality Issues (1)

Severity Location Issue
🟡 Warning go.mod:1
The pull request, aimed at resolving CVEs by updating dependencies, lacks specific details in its description. It doesn't list the CVE identifiers being addressed, which makes it difficult to verify the necessity and effectiveness of the version bumps. This information is critical for security auditing and future maintenance.
💡 SuggestionUpdate the pull request description to include a list of the specific CVEs that are mitigated by these dependency upgrades. Linking to the relevant security advisories for each updated package would provide valuable context and improve the audit trail for these security-related changes.

Powered by Visor from Probelabs

Last updated: 2026-06-19T16:04:15.778Z | Triggered by: pr_updated | Commit: e32a548

💡 TIP: You can chat with Visor using /visor ask <your question>

@MFCaballero MFCaballero added the deps-reviewed Dependency changes reviewed and approved for CI execution label Jun 15, 2026
@sentinelone-cnapp-eu1

sentinelone-cnapp-eu1 Bot commented Jun 19, 2026

Copy link
Copy Markdown

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

@github-actions

github-actions Bot commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🚨 Jira Linter Failed

Commit: e32a548
Failed at: 2026-06-19 16:02:50 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details 
failed to get Jira issue: failed to fetch Jira issue TT-17446: Issue does not exist or you do not have permission to see it.: request failed. Please analyze the request body for more details. Status code: 404

Next Steps

  • Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
  • Verify your PR title matches the branch's Jira ticket ID
  • Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

@sonarqubecloud

sonarqubecloud Bot commented Jun 19, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

vladzabolotnyi
vladzabolotnyi approved these changes Jun 22, 2026
View reviewed changes

@vladzabolotnyi vladzabolotnyi left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Compared with a list from the ticket. Well done!

@lghiur
lghiur merged commit 35b7c3d into master Jun 22, 2026
54 of 56 checks passed
@lghiur
lghiur deleted the TT-17446 branch June 22, 2026 12:10
@lghiur

lghiur commented Jun 22, 2026

Copy link
Copy Markdown
Collaborator

/release to release-5.13

@lghiur

lghiur commented Jun 22, 2026

Copy link
Copy Markdown
Collaborator

/release to release-5.13.1

@probelabs

probelabs Bot commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

✅ Cherry-pick successful. A PR was created: #8339

This was referenced Jun 22, 2026
Merged
Merged
@probelabs

probelabs Bot commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

✅ Cherry-pick successful. A PR was created: #8340

lghiur pushed a commit that referenced this pull request Jun 22, 2026
@probelabs @MFCaballero
Merging to release-5.13: [TT-17446] Tyk Gateway 5.13.1/5.14.0 CVEs (#…
213381b 
…8315) (#8339)

[TT-17446] Tyk Gateway 5.13.1/5.14.0 CVEs (#8315)

<!-- Provide a general summary of your changes in the Title above -->

## Description
- upgrade github.com/jackc/pgx/v5 to v5.9.2
- upgrade golang.org/x/crypto to v0.52.0
- upgrade golang.org/x/net to v0.55.0
- upgrade golang.org/x/image to v0.41.0
- upgrade golang.org/x/sys to v0.46.0 (minimum required by downgraded
golang.org/x/crypto v0.52.0 and downgraded golang.org/x/net v0.55.0)

## Related Issue

<!-- This project only accepts pull requests related to open issues. -->
<!-- If suggesting a new feature or change, please discuss it in an
issue first. -->
<!-- If fixing a bug, there should be an issue describing it with steps
to reproduce. -->
<!-- OSS: Please link to the issue here. Tyk: please create/link the
JIRA ticket. -->

## Motivation and Context

<!-- Why is this change required? What problem does it solve? -->

## How This Has Been Tested

<!-- Please describe in detail how you tested your changes -->
<!-- Include details of your testing environment, and the tests -->
<!-- you ran to see how your change affects other areas of the code,
etc. -->
<!-- This information is helpful for reviewers and QA. -->

## Screenshots (if appropriate)

## Types of changes

<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Refactoring or add test (improvements in base code or adds test
coverage to functionality)

## Checklist

<!-- Go over all the following points, and put an `x` in all the boxes
that apply -->
<!-- If there are no documentation updates required, mark the item as
checked. -->
<!-- Raise up any additional concerns not covered by the checklist. -->

- [ ] I ensured that the documentation is up to date
- [ ] I explained why this PR updates go.mod in detail with reasoning
why it's required
- [ ] I would like a code coverage CI quality gate exception and have
explained why

[TT-17446]:
https://tyktech.atlassian.net/browse/TT-17446?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

Co-authored-by: Florencia Caballero <[email protected]>
lghiur pushed a commit that referenced this pull request Jun 22, 2026
@probelabs @MFCaballero
Merging to release-5.13.1: [TT-17446] Tyk Gateway 5.13.1/5.14.0 CVEs (#…
a2b1ce1 
…8315) (#8340)

[TT-17446] Tyk Gateway 5.13.1/5.14.0 CVEs (#8315)

<!-- Provide a general summary of your changes in the Title above -->

## Description
- upgrade github.com/jackc/pgx/v5 to v5.9.2
- upgrade golang.org/x/crypto to v0.52.0
- upgrade golang.org/x/net to v0.55.0
- upgrade golang.org/x/image to v0.41.0
- upgrade golang.org/x/sys to v0.46.0 (minimum required by downgraded
golang.org/x/crypto v0.52.0 and downgraded golang.org/x/net v0.55.0)

## Related Issue

<!-- This project only accepts pull requests related to open issues. -->
<!-- If suggesting a new feature or change, please discuss it in an
issue first. -->
<!-- If fixing a bug, there should be an issue describing it with steps
to reproduce. -->
<!-- OSS: Please link to the issue here. Tyk: please create/link the
JIRA ticket. -->

## Motivation and Context

<!-- Why is this change required? What problem does it solve? -->

## How This Has Been Tested

<!-- Please describe in detail how you tested your changes -->
<!-- Include details of your testing environment, and the tests -->
<!-- you ran to see how your change affects other areas of the code,
etc. -->
<!-- This information is helpful for reviewers and QA. -->

## Screenshots (if appropriate)

## Types of changes

<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Refactoring or add test (improvements in base code or adds test
coverage to functionality)

## Checklist

<!-- Go over all the following points, and put an `x` in all the boxes
that apply -->
<!-- If there are no documentation updates required, mark the item as
checked. -->
<!-- Raise up any additional concerns not covered by the checklist. -->

- [ ] I ensured that the documentation is up to date
- [ ] I explained why this PR updates go.mod in detail with reasoning
why it's required
- [ ] I would like a code coverage CI quality gate exception and have
explained why

[TT-17446]:
https://tyktech.atlassian.net/browse/TT-17446?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

Co-authored-by: Florencia Caballero <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kofoworola kofoworola kofoworola approved these changes
@vladzabolotnyi vladzabolotnyi vladzabolotnyi approved these changes

Assignees

No one assigned

Labels

deps-reviewed Dependency changes reviewed and approved for CI execution

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@MFCaballero @lghiur @kofoworola @vladzabolotnyi