Skip to content

Merging to release-5.13.1: [TT-17446] Tyk Gateway 5.13.1/5.14.0 CVEs (#8315)#8340

Merged
lghiur merged 1 commit into
release-5.13.1from
merge/release-5.13.1/35b7c3d51ae9b20dc66704c6fe7e909da45e8a8d/TT-17446
Jun 22, 2026
Merged

Merging to release-5.13.1: [TT-17446] Tyk Gateway 5.13.1/5.14.0 CVEs (#8315)#8340
lghiur merged 1 commit into
release-5.13.1from
merge/release-5.13.1/35b7c3d51ae9b20dc66704c6fe7e909da45e8a8d/TT-17446

Conversation

@probelabs

@probelabs probelabs Bot commented Jun 22, 2026 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Contributor

TT-17446 Tyk Gateway 5.13.1/5.14.0 CVEs (#8315)

Description

  • upgrade github.com/jackc/pgx/v5 to v5.9.2
  • upgrade golang.org/x/crypto to v0.52.0
  • upgrade golang.org/x/net to v0.55.0
  • upgrade golang.org/x/image to v0.41.0
  • upgrade golang.org/x/sys to v0.46.0 (minimum required by downgraded
    golang.org/x/crypto v0.52.0 and downgraded golang.org/x/net v0.55.0)

Related Issue

Motivation and Context

How This Has Been Tested

Screenshots (if appropriate)

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing
    functionality to change)
  • Refactoring or add test (improvements in base code or adds test
    coverage to functionality)

Checklist

  • I ensured that the documentation is up to date
  • I explained why this PR updates go.mod in detail with reasoning
    why it's required
  • I would like a code coverage CI quality gate exception and have
    explained why

@MFCaballero
[TT-17446] Tyk Gateway 5.13.1/5.14.0 CVEs (#8315)
1a15d46 
<!-- Provide a general summary of your changes in the Title above -->

## Description
- upgrade github.com/jackc/pgx/v5 to v5.9.2
- upgrade golang.org/x/crypto to v0.52.0
- upgrade golang.org/x/net to v0.55.0
- upgrade golang.org/x/image to v0.41.0
- upgrade golang.org/x/sys to v0.46.0 (minimum required by downgraded
golang.org/x/crypto v0.52.0 and downgraded golang.org/x/net v0.55.0)

## Related Issue

<!-- This project only accepts pull requests related to open issues. -->
<!-- If suggesting a new feature or change, please discuss it in an
issue first. -->
<!-- If fixing a bug, there should be an issue describing it with steps
to reproduce. -->
<!-- OSS: Please link to the issue here. Tyk: please create/link the
JIRA ticket. -->

## Motivation and Context

<!-- Why is this change required? What problem does it solve? -->

## How This Has Been Tested

<!-- Please describe in detail how you tested your changes -->
<!-- Include details of your testing environment, and the tests -->
<!-- you ran to see how your change affects other areas of the code,
etc. -->
<!-- This information is helpful for reviewers and QA. -->

## Screenshots (if appropriate)

## Types of changes

<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Refactoring or add test (improvements in base code or adds test
coverage to functionality)

## Checklist

<!-- Go over all the following points, and put an `x` in all the boxes
that apply -->
<!-- If there are no documentation updates required, mark the item as
checked. -->
<!-- Raise up any additional concerns not covered by the checklist. -->

- [ ] I ensured that the documentation is up to date
- [ ] I explained why this PR updates go.mod in detail with reasoning
why it's required
- [ ] I would like a code coverage CI quality gate exception and have
explained why

(cherry picked from commit 35b7c3d)
@probelabs probelabs Bot mentioned this pull request Jun 22, 2026
Merged
7 tasks
@sentinelone-cnapp-eu1

sentinelone-cnapp-eu1 Bot commented Jun 22, 2026

Copy link
Copy Markdown

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

@probelabs

probelabs Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

This pull request addresses security vulnerabilities (CVEs) by updating several Go dependencies in the Tyk Gateway. The changes are confined to the go.mod and go.sum files, reflecting a maintenance task to improve the security posture of the application.

Files Changed Analysis

  • go.mod & go.sum: These files were modified to update the versions of direct and indirect dependencies. This is a standard procedure for managing Go modules and ensuring the integrity of the dependency graph.

The following dependencies were upgraded:

  • github.com/jackc/pgx/v5: v5.9.1 -> v5.9.2
  • golang.org/x/crypto: v0.49.0 -> v0.52.0
  • golang.org/x/net: v0.52.0 -> v0.55.0
  • golang.org/x/image: v0.39.0 -> v0.41.0
  • golang.org/x/sys: v0.42.0 -> v0.46.0
  • Other transitive dependencies like golang.org/x/sync, golang.org/x/mod, golang.org/x/term, golang.org/x/text, and golang.org/x/tools were also updated.

Architecture & Impact Assessment

  • Accomplishment: The PR mitigates potential security risks by incorporating patched versions of third-party libraries.
  • Technical Changes: The core change is the modification of dependency constraints in go.mod. No application logic or source code has been altered.
  • Affected Components: The entire gateway application is affected as it will be rebuilt and run with the new dependency versions. While the risk of functional regression is generally low for minor/patch updates, key areas to consider for testing would be those interacting with PostgreSQL (pgx), and any components utilizing advanced networking (net) or cryptographic (crypto) features.

Scope Discovery & Context Expansion

  • Scope: The scope is limited to dependency management. The impact, however, is global across the application wherever these libraries are used. For instance, pgx is used for PostgreSQL connectivity, which is a core data storage option. The golang.org/x/ packages are fundamental libraries used for a wide range of operations including networking, system calls, and cryptography, making their update significant for overall system security and stability.
  • Further Exploration: To assess the full impact, a reviewer should:
    1. Investigate the specific CVEs addressed by these version bumps to understand the nature of the vulnerabilities being fixed.
    2. Review the changelogs for each updated dependency to identify any potentially breaking changes, although none are expected in these minor/patch versions.
    3. Ensure that regression tests pass, particularly focusing on database connectivity and any features that rely on the golang.org/x/net and golang.org/x/crypto packages.
Metadata
  • Review Effort: 2 / 5
  • Primary Label: chore

Powered by Visor from Probelabs

Last updated: 2026-06-22T12:13:33.263Z | Triggered by: pr_opened | Commit: 1a15d46

💡 TIP: You can chat with Visor using /visor ask <your question>

@probelabs

probelabs Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

\n\n

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

\n\n

✅ Performance Check Passed

No performance issues found – changes LGTM.

✅ Quality Check Passed

No quality issues found – changes LGTM.

Powered by Visor from Probelabs

Last updated: 2026-06-22T12:13:02.150Z | Triggered by: pr_opened | Commit: 1a15d46

💡 TIP: You can chat with Visor using /visor ask <your question>

@github-actions

github-actions Bot commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

🚨 Jira Linter Failed

Commit: 1a15d46
Failed at: 2026-06-22 12:17:29 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details 
failed to get Jira issue: failed to fetch Jira issue TT-17446: Issue does not exist or you do not have permission to see it.: request failed. Please analyze the request body for more details. Status code: 404

Next Steps

  • Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
  • Verify your PR title matches the branch's Jira ticket ID
  • Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

@lghiur lghiur added the deps-reviewed Dependency changes reviewed and approved for CI execution label Jun 22, 2026
@sonarqubecloud

sonarqubecloud Bot commented Jun 22, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@lghiur
lghiur merged commit a2b1ce1 into release-5.13.1 Jun 22, 2026
85 of 116 checks passed
@lghiur
lghiur deleted the merge/release-5.13.1/35b7c3d51ae9b20dc66704c6fe7e909da45e8a8d/TT-17446 branch June 22, 2026 14:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

deps-reviewed Dependency changes reviewed and approved for CI execution

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lghiur @MFCaballero