🎯 Recommended Merge Targets

Based on JIRA ticket TT-17569: Fix CVE in storage library

Fix Version: Tyk MDCB 2.12.0

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

Fix Version: Tyk Portal 1.18.0

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

Fix Version: Tyk Identity Broker 1.7.3

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

Fix Version: Tyk 5.8.15

Required:

• release-5.8.15 - Exact version branch for Tyk 5.8.15 - specific patch release
• release-5.8 - Minor version branch for 5.8.x patches - required for creating Tyk 5.8.15
• master - Main development branch - ensures fix is in all future releases

Fix Version: Tyk 5.13.1

Required:

• release-5.13.1 - Exact version branch for Tyk 5.13.1 - specific patch release
• release-5.13 - Minor version branch for 5.13.x patches - required for creating Tyk 5.13.1
• master - Main development branch - ensures fix is in all future releases

Fix Version: Tyk 5.14.0

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

Fix Version: Storage 1.3.3

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

Fix Version: Storage 1.3.4

⚠️ Warning: Expected release branches not found in repository

Required:

• master - No matching release branches found. Fix will be included in future releases.

📋 Workflow

1. Merge this PR to master first

2. Cherry-pick to release branches by commenting on the merged PR:

   • /release to release-5.8.15
   • /release to release-5.8
   • /release to release-5.13.1
   • /release to release-5.13

3. Automated backport - The bot will automatically create backport PRs to the specified release branches

This pull request addresses security vulnerabilities by updating the github.com/TykTechnologies/storage dependency from v1.3.1 to v1.3.4. This change transitively upgrades go.mongodb.org/mongo-driver to v1.17.7 and golang.org/x/crypto to v0.52.0, patching known CVEs.

Files Changed Analysis

The changes are confined to go.mod and go.sum, which is expected for a dependency update. The modifications update the version constraints for the direct dependency github.com/TykTechnologies/storage and the indirect dependency go.mongodb.org/mongo-driver, along with their corresponding checksums in go.sum.

• go.mod: The required version of github.com/TykTechnologies/storage is bumped, and the indirect mongo-driver version is updated.
• go.sum: Checksums are updated to match the new versions of the dependencies.

Architecture & Impact Assessment

• What this PR accomplishes: It patches critical security vulnerabilities, specifically CVE-2026-2303 (a heap out-of-bounds read in the MongoDB driver's GSSAPI/Kerberos wrapper) and recent SSH advisories in the x/crypto package. This enhances the overall security of the Tyk gateway.

• Key technical changes introduced: The only technical change is the version bump of dependencies. There are no direct code modifications within the Tyk repository. The functional changes are encapsulated within the updated third-party packages.

• Affected system components: The storage package is a fundamental component for data persistence. Therefore, any part of the system that interacts with the storage layer for API definitions, security policies, keys, or analytics is implicitly affected. The most direct impact is on deployments utilizing MongoDB as a storage backend, especially those using GSSAPI/Kerberos authentication.

graph TD
    A[Tyk Gateway] --> B["storage v1.3.4"];
    subgraph sg1 ["Transitive Dependencies Updated"]
        B --> C["mongo-driver v1.17.7"];
        B --> D["golang.org/x/crypto v0.52.0"];
    end
    subgraph sg2 ["Vulnerabilities Addressed"]
        C --> E[CVE-2026-2303];
        D --> F[SSH Advisories];
    end

Scope Discovery & Context Expansion

While the code change itself is minimal, the scope of its impact relates to the security and stability of the data persistence layer. The update to the storage library and its dependencies touches all core gateway operations that rely on data persistence.

• Data Persistence: All CRUD (Create, Read, Update, Delete) operations for API definitions, policies, and session keys that are managed by the storage package will now execute using the patched mongo-driver.
• Authentication: The fix in mongo-driver is specific to the GSSAPI/Kerberos authentication mechanism. Deployments using this authentication method with a MongoDB backend are the most critically affected and should be prioritized for regression testing.
• Risk Assessment: The primary risk is the introduction of a regression or a breaking API change from the dependency updates. Since these are patch/minor version bumps, the risk is considered low. However, given the security-critical nature of the storage component, thorough validation is recommended.
• Next Steps: A focused testing effort should be directed at verifying the stability of MongoDB integrations, particularly those using Kerberos authentication. A full run of the existing regression test suite is also advised to ensure no unintended side effects have been introduced.

Powered by Visor from Probelabs

Last updated: 2026-06-22T15:41:13.192Z | Triggered by: pr_updated | Commit: 34b085a

💡 TIP: You can chat with Visor using /visor ask <your question>

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

✅ Quality Check Passed

No quality issues found – changes LGTM.

Powered by Visor from Probelabs

Last updated: 2026-06-22T15:41:11.643Z | Triggered by: pr_updated | Commit: 34b085a

💡 TIP: You can chat with Visor using /visor ask <your question>

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

🚨 Jira Linter Failed

Commit: 34b085a
Failed at: 2026-06-22 15:52:18 UTC

The Jira linter failed to validate your PR. Please check the error details below:

failed to get Jira issue: failed to fetch Jira issue TT-17569: Issue does not exist or you do not have permission to see it.: request failed. Please analyze the request body for more details. Status code: 404

Next Steps

• Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
• Verify your PR title matches the branch's Jira ticket ID
• Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud