Skip to content

chore(deps): update module golang.org/x/oauth2 to v0.27.0 [security] (release-1.18) #6313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jbw976 merged 4 commits into from
Mar 18, 2025
Merged

chore(deps): update module golang.org/x/oauth2 to v0.27.0 [security] (release-1.18) #6313

jbw976 merged 4 commits into from
Mar 18, 2025

Conversation

@crossplane-renovate
Copy link
Contributor

@crossplane-renovate crossplane-renovate bot commented Mar 5, 2025

This PR contains the following updates:

Package Type Update Change
golang.org/x/oauth2 indirect minor v0.22.0 -> v0.27.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Unexpected memory consumption during token parsing in golang.org/x/oauth2

CVE-2025-22868 / GO-2025-3488

More information

Details

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@crossplane-renovate crossplane-renovate bot requested a review from a team as a code owner March 5, 2025 08:17
@crossplane-renovate crossplane-renovate bot requested a review from phisco March 5, 2025 08:17
@crossplane-renovate
Copy link
Contributor Author

crossplane-renovate bot commented Mar 5, 2025 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.mod
Command failed: earthly --strict +go-generate
 Init 🚀
————————————————————————————————————————————————————————————————————————————————

           buildkitd | Found buildkit daemon as docker container (earthly-buildkitd)

 Build 🔧
————————————————————————————————————————————————————————————————————————————————

              logbus | Setting organization "crossplane" and project "crossplane"
        +go-generate | --> FROM +base
        +go-generate | --> FROM +go-modules
         +go-modules | --> FROM +base
       golang:1.22.8 | --> Load metadata golang:1.22.8 linux/amd64
      +kubectl-setup | --> FROM +base
        c/curl:8.8.0 | --> Load metadata curlimages/curl:8.8.0 linux/amd64
         +go-modules | --> FROM golang:1.22.8
         +go-modules | [----------] 100% FROM golang:1.22.8�[K
         +go-modules | *cached* --> WORKDIR /crossplane
         +go-modules | --> COPY go.mod go.sum ./
         +go-modules | --> RUN go mod download
         +go-modules | go: go.mod requires go >= 1.23.0 (running go 1.22.8; GOTOOLCHAIN=local)
         +go-modules | ERROR Earthfile:113:2
         +go-modules |       The command
         +go-modules |           RUN go mod download
         +go-modules |       did not complete successfully. Exit code 1

================================== ❌ FAILURE ===================================

         +go-modules *failed* | Repeating the failure error...
         +go-modules *failed* | --> RUN go mod download
         +go-modules *failed* | go: go.mod requires go >= 1.23.0 (running go 1.22.8; GOTOOLCHAIN=local)
         +go-modules *failed* | ERROR Earthfile:113:2
         +go-modules *failed* |       The command
         +go-modules *failed* |           RUN go mod download
         +go-modules *failed* |       did not complete successfully. Exit code 1

Help: To debug your build, you can use the --interactive (-i) flag to drop into a shell of the failing RUN step: "earthly -i --strict +go-generate"

🛰️ Reuse cache between CI runs with Earthly Satellites! 2-20X faster than without cache. Generous free tier https://cloud.earthly.dev

@crossplane-renovate crossplane-renovate bot force-pushed the renovate/release-1.18-go-golang.org-x-oauth2-vulnerability branch from b792aa0 to bb64a4c Compare March 14, 2025 08:17
@jbw976 jbw976 mentioned this pull request Mar 18, 2025
Closed
@jbw976
Copy link
Member

jbw976 commented Mar 18, 2025

lint is failing with Exit code 137 (out of memory):
https://github.com/crossplane/crossplane/actions/runs/13912729218/job/38930124049?pr=6313

@crossplane-renovate
Copy link
Contributor Author

crossplane-renovate bot commented Mar 18, 2025

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@jbw976 jbw976 requested a review from negz as a code owner March 18, 2025 15:24
jbw976 and others added 2 commits March 18, 2025 08:46
@jbw976
chore(deps): bump version of golangci-lint to v1.62.2
2a94097 
Signed-off-by: Jared Watts <[email protected]>
@phisco @jbw976
chore: linting
5474c24 
Signed-off-by: Philippe Scorsolini <[email protected]>
(cherry picked from commit 037f7c8)
@jbw976 jbw976 force-pushed the renovate/release-1.18-go-golang.org-x-oauth2-vulnerability branch from 021d357 to 5474c24 Compare March 18, 2025 15:50
@jbw976
Copy link
Member

jbw976 commented Mar 18, 2025

@phisco I would definitely appreciate your quick eyes on this PR! This PR started as a simple oauth2 bump, but also brought in:

  • Renovate automatically bumped golang to v1.23.7, but only in go.mod
  • I bumped golang to same version in Earthfile
  • older golangci-lint version is running out of memory on new golang version
  • bump golangci-lint to newer v1.62.2, which uncovered new linter errors
  • you fixed these in main in 037f7c8, so I cherry-picked that commit
  • check-diff is failing and needed to run earthly +generate: 5474c24#diff-a44cbffff9be3b4e03352b68e867b1b315bf8fb2a69794260964dce2395676db
    • ^^ this is the one I most want your eyes on, is this generated code change from the non-pointer receiver changing to a pointer receiver safe to do in this release branch? 🤔

@jbw976 jbw976 mentioned this pull request Mar 18, 2025
Merged
1 task
phisco
phisco approved these changes Mar 18, 2025
View reviewed changes
Copy link
Contributor

@phisco phisco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Renovate automatically bumped golang to v1.23.7, but only in go.mod

This is weird, but I lost the hope to understand what's going on with go.mod toolchain and such a while ago, so fine, I guess...

yes, it's safe, all changed methods are only reading the struct.

Thank you for taking care of this, @jbw976!

@jbw976 jbw976 merged commit b3eec14 into release-1.18 Mar 18, 2025
17 of 19 checks passed
@crossplane-renovate crossplane-renovate bot deleted the renovate/release-1.18-go-golang.org-x-oauth2-vulnerability branch March 18, 2025 18:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jbw976 jbw976 jbw976 approved these changes

@phisco phisco phisco approved these changes

@negz negz Awaiting requested review from negz negz is a code owner

Assignees

No one assigned

Labels

automated

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jbw976 @phisco