Skip to content

Bump go-jose/go-jose to v4.1.4 to fix GHSA-78h2-9frx-2jm8#13286

Merged
mxpv merged 1 commit into
containerd:mainfrom
chrischangcode:cve-2026-34986
Apr 26, 2026
Merged

Bump go-jose/go-jose to v4.1.4 to fix GHSA-78h2-9frx-2jm8#13286
mxpv merged 1 commit into
containerd:mainfrom
chrischangcode:cve-2026-34986

Conversation

@chrischangcode

@chrischangcode chrischangcode commented Apr 24, 2026

Copy link
Copy Markdown
Contributor

Summary

Bump github.com/go-jose/go-jose/v4 from v4.1.3 to v4.1.4 to address a high-severity vulnerability:

Changes

  • Updated go.mod indirect dependency from v4.1.3 → v4.1.4
  • Ran go mod tidy and go mod vendor to update go.sum and vendored sources
  • Verified make build succeeds

Backport Plan

Per RELEASES.md, this fix needs to be backported to all active and LTS release branches:

Branch Status EOL Backport needed
release/1.7 LTS September 2026 Yes (if go-jose is a dependency)
release/2.0 LTS March 2027 Yes
release/2.1 Active May 2026 Yes
release/2.2 Active November 2026 Yes

Next Steps

After this PR merges into main:

  1. Cherry-pick the commit to each active release branch listed above
  2. Run go mod tidy && go mod vendor && make build on each branch to verify
  3. Open backport PRs with [release/X.Y] prefix in the title per RELEASES.md backporting guidelines
  4. Tag patch releases as needed

Copilot AI review requested due to automatic review settings April 24, 2026 16:25
@github-project-automation github-project-automation Bot moved this to Needs Triage in Pull Request Review Apr 24, 2026
@dosubot dosubot Bot added the dependencies Pull requests that update a dependency file label Apr 24, 2026
Copilot AI reviewed Apr 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the vendored github.com/go-jose/go-jose/v4 dependency to v4.1.4 to address GHSA-78h2-9frx-2jm8, bringing in upstream hardening around JWE key unwrapping.

Changes:

  • Bumped github.com/go-jose/go-jose/v4 from v4.1.3 → v4.1.4 in go.mod/go.sum.
  • Updated vendored module metadata (vendor/modules.txt) for the new version.
  • Pulled in upstream vendored fixes adding stricter validation for missing recipients / encrypted keys during JWE decrypt and key unwrapping.

Reviewed changes

Copilot reviewed 1 out of 6 changed files in this pull request and generated no comments.

Show a summary per file
File Description
go.mod Bumps indirect go-jose requirement to v4.1.4.
go.sum Updates checksums for go-jose v4.1.4.
vendor/modules.txt Reflects the vendored go-jose v4.1.4 module version.
vendor/github.com/go-jose/go-jose/v4/symmetric.go Upstream hardening: validates recipient/encrypted key; uses bytes.Clone for DIRECT.
vendor/github.com/go-jose/go-jose/v4/asymmetric.go Upstream hardening: validates recipient/encrypted key before unwrap in ECDH-ES paths.
vendor/github.com/go-jose/go-jose/v4/cipher/key_wrap.go Upstream hardening: rejects too-short wrapped keys before unwrapping.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@chrischangcode chrischangcode mentioned this pull request Apr 24, 2026
Open
thaJeztah
thaJeztah approved these changes Apr 25, 2026
View reviewed changes

@thaJeztah thaJeztah left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@github-project-automation github-project-automation Bot moved this from Needs Triage to Review In Progress in Pull Request Review Apr 25, 2026
@mxpv
mxpv added this pull request to the merge queue Apr 26, 2026
Merged via the queue into containerd:main with commit b6a45a1 Apr 26, 2026
93 of 96 checks passed
@github-project-automation github-project-automation Bot moved this from Review In Progress to Done in Pull Request Review Apr 26, 2026
@smerkviladze smerkviladze mentioned this pull request Apr 27, 2026
Merged
@cpuguy83

cpuguy83 commented Apr 28, 2026

Copy link
Copy Markdown
Member

/cherry-pick release/2.1 release/2.0

@k8s-infra-cherrypick-robot

k8s-infra-cherrypick-robot commented Apr 28, 2026

Copy link
Copy Markdown

@cpuguy83: #13286 failed to apply on top of branch "release/2.1":

Applying: chore: update go-jose for CVE-2026-34986
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 chore: update go-jose for CVE-2026-34986
Details

In response to this:

/cherry-pick release/2.1 release/2.0

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@smerkviladze smerkviladze mentioned this pull request Apr 29, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@thaJeztah thaJeztah thaJeztah approved these changes
@fuweid fuweid fuweid approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file size/M

Projects

Pull Request Review
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@chrischangcode @cpuguy83 @k8s-infra-cherrypick-robot @thaJeztah @fuweid @mxpv @k8s-ci-robot