fix(deps): update Go dependencies to resolve known CVEs#447
Merged
raballew merged 1 commit intoApr 9, 2026
Merged
Conversation
✅ Deploy Preview for jumpstarter-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (2)
📝 WalkthroughWalkthroughUpdated Go module dependencies across two files by bumping versions for multiple packages including security-related libraries ( Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
controller/deploy/operator/go.mod (1)
100-107: Consider aligning OTel exporter versions with the upgraded core OTel modules.
go.opentelemetry.io/otel,/metric,/sdk, and/traceare nowv1.39.0, whileotlptrace/otlptracegrpcin the same file remain atv1.37.0(Line 103-104). This mixed minor set often works, but aligning them usually reduces drift and subtle integration issues.Suggested manifest alignment
- go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 // indirect🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@controller/deploy/operator/go.mod` around lines 100 - 107, The go.mod has a version mismatch: core OTel modules (go.opentelemetry.io/otel, /metric, /sdk, /trace) are at v1.39.0 while the exporters go.opentelemetry.io/otel/exporters/otlp/otlptrace and .../otlptracegrpc are at v1.37.0; update the otlptrace and otlptracegrpc entries to v1.39.0 to align with the core modules, then run module resolution (e.g., go mod tidy / go get) to reconcile dependencies so everything uses the same minor version.python/packages/jumpstarter/jumpstarter/common/utils_test.py (1)
65-117: Add malformed-JSON regression coverage for label parsing.Current parsing tests are good, but adding one malformed JSON case will lock in fail-soft behavior for env corruption edge cases.
✅ Suggested test
+def test_parse_labels_malformed_json_returns_empty_dict(): + labels = ExporterMetadata._parse_labels('{"board":"rpi4"') + assert labels == {}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@python/packages/jumpstarter/jumpstarter/common/utils_test.py` around lines 65 - 117, Add a test that ensures malformed JSON in the JMP_EXPORTER_LABELS env var is handled fail-soft (no exception and returns empty labels); create a new test in python/packages/jumpstarter/jumpstarter/common/utils_test.py (e.g., test_parse_labels_malformed_json) that sets JMP_EXPORTER_LABELS to invalid JSON (like '{"key": "val",') and calls ExporterMetadata._parse_labels (or ExporterMetadata.from_env) asserting it returns {} (and that from_env does not raise and yields meta.labels == {}).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@python/packages/jumpstarter/jumpstarter/utils/env.py`:
- Around line 40-43: When parsing JMP_EXPORTER_LABELS in from_env(), guard the
json.loads(raw) call with a try/except catching json.JSONDecodeError so
malformed JSON doesn't crash env_with_metadata() or env_with_metadata_async();
on JSONDecodeError fall back to the existing legacy parsing logic (the branch
that builds labels: dict[str,str]) and log or ignore the bad JSON as appropriate
so metadata loading continues. Ensure you reference JMP_EXPORTER_LABELS parsing
in from_env() and handle the exception around the json.loads(raw) call.
---
Nitpick comments:
In `@controller/deploy/operator/go.mod`:
- Around line 100-107: The go.mod has a version mismatch: core OTel modules
(go.opentelemetry.io/otel, /metric, /sdk, /trace) are at v1.39.0 while the
exporters go.opentelemetry.io/otel/exporters/otlp/otlptrace and
.../otlptracegrpc are at v1.37.0; update the otlptrace and otlptracegrpc entries
to v1.39.0 to align with the core modules, then run module resolution (e.g., go
mod tidy / go get) to reconcile dependencies so everything uses the same minor
version.
In `@python/packages/jumpstarter/jumpstarter/common/utils_test.py`:
- Around line 65-117: Add a test that ensures malformed JSON in the
JMP_EXPORTER_LABELS env var is handled fail-soft (no exception and returns empty
labels); create a new test in
python/packages/jumpstarter/jumpstarter/common/utils_test.py (e.g.,
test_parse_labels_malformed_json) that sets JMP_EXPORTER_LABELS to invalid JSON
(like '{"key": "val",') and calls ExporterMetadata._parse_labels (or
ExporterMetadata.from_env) asserting it returns {} (and that from_env does not
raise and yields meta.labels == {}).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 240b257b-4446-41b6-94c3-4e86589b042e
⛔ Files ignored due to path filters (2)
controller/deploy/operator/go.sumis excluded by!**/*.sumcontroller/go.sumis excluded by!**/*.sum
📒 Files selected for processing (7)
controller/deploy/operator/go.modcontroller/go.modpython/packages/jumpstarter/jumpstarter/client/lease.pypython/packages/jumpstarter/jumpstarter/common/utils.pypython/packages/jumpstarter/jumpstarter/common/utils_test.pypython/packages/jumpstarter/jumpstarter/config/env.pypython/packages/jumpstarter/jumpstarter/utils/env.py
mangelajo
reviewed
Apr 9, 2026
mangelajo
requested changes
Apr 9, 2026
Update vulnerable dependencies in controller/go.mod and controller/deploy/operator/go.mod to address 8 known CVEs: - google.golang.org/grpc v1.70.0 -> v1.80.0 (GO-2026-4762, authorization bypass) - github.com/golang-jwt/jwt/v5 v5.2.1 -> v5.3.1 (GO-2025-3553, memory exhaustion) - golang.org/x/net v0.38.0 -> v0.49.0 (GO-2026-4441, GO-2026-4440) - github.com/go-jose/go-jose/v4 v4.0.4 -> v4.1.3 (GO-2025-3485, DoS) - golang.org/x/crypto v0.36.0 -> v0.47.0 (GO-2025-4135, GO-2025-4134, GO-2025-4116) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
raballew
force-pushed
the
041-fix-dependency-vulnerabilities
branch
from
2f2d4b3 to
1f5ef14
Compare
mangelajo
approved these changes
Apr 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
controller/go.modandcontroller/deploy/operator/go.modto resolve 9 known CVEs identified bygovulncheckGo dependency updates
google.golang.org/grpcgithub.com/golang-jwt/jwt/v5golang.org/x/netgithub.com/go-jose/go-jose/v4golang.org/x/cryptoCloses: #26
Test plan
govulncheck ./...incontroller/reports zero symbol-level vulnerabilities for the targeted modules🤖 Generated with Claude Code