Skip to content

chore(deps): update module golang.org/x/oauth2 to v0.27.0 [security] (release-1.17) #6311

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jbw976 merged 5 commits into from
Mar 18, 2025
Merged

chore(deps): update module golang.org/x/oauth2 to v0.27.0 [security] (release-1.17) #6311

jbw976 merged 5 commits into from
Mar 18, 2025

Conversation

@crossplane-renovate
Copy link
Contributor

@crossplane-renovate crossplane-renovate bot commented Mar 5, 2025

This PR contains the following updates:

Package Type Update Change
golang.org/x/oauth2 indirect minor v0.17.0 -> v0.27.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Unexpected memory consumption during token parsing in golang.org/x/oauth2

CVE-2025-22868 / GO-2025-3488

More information

Details

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@crossplane-renovate crossplane-renovate bot requested a review from a team as a code owner March 5, 2025 08:17
@crossplane-renovate crossplane-renovate bot requested a review from turkenh March 5, 2025 08:17
@crossplane-renovate
Copy link
Contributor Author

crossplane-renovate bot commented Mar 5, 2025 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.mod
Command failed: earthly --strict +go-generate
 Init 🚀
————————————————————————————————————————————————————————————————————————————————

           buildkitd | Found buildkit daemon as docker container (earthly-buildkitd)

 Build 🔧
————————————————————————————————————————————————————————————————————————————————

              logbus | Setting organization "crossplane" and project "crossplane"
        +go-generate | --> FROM +base
        +go-generate | --> FROM +go-modules
         +go-modules | --> FROM +base
       golang:1.22.8 | --> Load metadata golang:1.22.8 linux/amd64
Warning: you are not logged into registry-1.docker.io, you may experience rate-limitting when pulling images
      +kubectl-setup | --> FROM +base
        c/curl:8.8.0 | --> Load metadata curlimages/curl:8.8.0 linux/amd64
         +go-modules | --> FROM golang:1.22.8
         +go-modules | [----------] 100% FROM golang:1.22.8�[K
         +go-modules | *cached* --> WORKDIR /crossplane
         +go-modules | --> COPY go.mod go.sum ./
         +go-modules | --> RUN go mod download
         +go-modules | go: go.mod requires go >= 1.23.0 (running go 1.22.8; GOTOOLCHAIN=local)
         +go-modules | ERROR Earthfile:113:2
         +go-modules |       The command
         +go-modules |           RUN go mod download
         +go-modules |       did not complete successfully. Exit code 1

================================== ❌ FAILURE ===================================

         +go-modules *failed* | Repeating the failure error...
         +go-modules *failed* | --> RUN go mod download
         +go-modules *failed* | go: go.mod requires go >= 1.23.0 (running go 1.22.8; GOTOOLCHAIN=local)
         +go-modules *failed* | ERROR Earthfile:113:2
         +go-modules *failed* |       The command
         +go-modules *failed* |           RUN go mod download
         +go-modules *failed* |       did not complete successfully. Exit code 1

Help: To debug your build, you can use the --interactive (-i) flag to drop into a shell of the failing RUN step: "earthly -i --strict +go-generate"

🛰️ Reuse cache between CI runs with Earthly Satellites! 2-20X faster than without cache. Generous free tier https://cloud.earthly.dev

@crossplane-renovate crossplane-renovate bot force-pushed the renovate/release-1.17-go-golang.org-x-oauth2-vulnerability branch from 67fb61a to 2aaa9c0 Compare March 14, 2025 08:17
@jbw976
Copy link
Member

jbw976 commented Mar 18, 2025

lint is failing with Exit code 137 (out of memory):
https://github.com/crossplane/crossplane/actions/runs/13912740305/job/38930153670?pr=6311

@crossplane-renovate
Copy link
Contributor Author

crossplane-renovate bot commented Mar 18, 2025

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

jbw976 and others added 2 commits March 18, 2025 08:26
@jbw976
chore(deps): bump version of golangci-lint to v1.62.2
b765a90 
Signed-off-by: Jared Watts <[email protected]>
@phisco @jbw976
chore: linting
b62cfe4 
Signed-off-by: Philippe Scorsolini <[email protected]>
(cherry picked from commit 037f7c8)
@jbw976 jbw976 requested a review from negz as a code owner March 18, 2025 15:33
@jbw976 jbw976 force-pushed the renovate/release-1.17-go-golang.org-x-oauth2-vulnerability branch from 1662f74 to 6329daa Compare March 18, 2025 15:43
@jbw976
Copy link
Member

jbw976 commented Mar 18, 2025

@phisco same comment here as #6313 (comment) 🙏

@jbw976 jbw976 merged commit 2d72513 into release-1.17 Mar 18, 2025
15 of 18 checks passed
@crossplane-renovate crossplane-renovate bot deleted the renovate/release-1.17-go-golang.org-x-oauth2-vulnerability branch March 18, 2025 18:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jbw976 jbw976 jbw976 approved these changes

@turkenh turkenh Awaiting requested review from turkenh turkenh is a code owner automatically assigned from crossplane/crossplane-maintainers

@negz negz Awaiting requested review from negz negz is a code owner

Assignees

No one assigned

Labels

automated

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jbw976 @phisco