From 28b61ae39940f290c07dd635b2e82fbb7032de54 Mon Sep 17 00:00:00 2001 From: Vikrant Puppala Date: Wed, 9 Sep 2026 05:42:46 +0000 Subject: [PATCH] chore: address dependency security findings Upgrade Apache Thrift to 0.24.0 and document time-limited reachability suppressions for the unreachable x/crypto SSH advisories while retaining Go 1.25. Signed-off-by: Vikrant Puppala --- go.mod | 2 +- go.sum | 4 ++-- osv-scanner.toml | 20 ++++++++++++++++++++ 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 84b3032f..463c0930 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.25.0 require ( github.com/apache/arrow/go/v12 v12.0.1 - github.com/apache/thrift v0.23.0 + github.com/apache/thrift v0.24.0 github.com/coreos/go-oidc/v3 v3.5.0 github.com/golang-jwt/jwt/v5 v5.2.2 github.com/joho/godotenv v1.4.0 diff --git a/go.sum b/go.sum index 4754b0a8..2e0ec0f7 100644 --- a/go.sum +++ b/go.sum @@ -5,8 +5,8 @@ github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig= github.com/apache/arrow/go/v12 v12.0.1 h1:JsR2+hzYYjgSUkBSaahpqCetqZMr76djX80fF/DiJbg= github.com/apache/arrow/go/v12 v12.0.1/go.mod h1:weuTY7JvTG/HDPtMQxEUp7pU73vkLWMLpY67QwZ/WWw= -github.com/apache/thrift v0.23.0 h1:wKR6YnefQSEnxpEfmgTPuJibNG4bF0p2TK34tHLWi3s= -github.com/apache/thrift v0.23.0/go.mod h1:zPt6WxgvTOM6hF92y8C+MkEM5LMxZuk4JcQOiU4Esvs= +github.com/apache/thrift v0.24.0 h1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ= +github.com/apache/thrift v0.24.0/go.mod h1:zPt6WxgvTOM6hF92y8C+MkEM5LMxZuk4JcQOiU4Esvs= github.com/coreos/go-oidc/v3 v3.5.0 h1:VxKtbccHZxs8juq7RdJntSqtXFtde9YpNpGn0yqgEHw= github.com/coreos/go-oidc/v3 v3.5.0/go.mod h1:ecXRtV4romGPeO6ieExAsUK9cb/3fp9hXNz1tlv8PIM= github.com/coreos/go-systemd/v22 v22.3.3-0.20220203105225-a9a7ef127534/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= diff --git a/osv-scanner.toml b/osv-scanner.toml index 60c2d94d..92401615 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -37,3 +37,23 @@ id = "GO-2026-5932" # package is still unimported before re-adding the suppression. ignoreUntil = 2027-01-02 reason = "golang.org/x/crypto/openpgp not imported by this driver (verified via go list -deps); advisory has no fixed version by design (package deprecated). Re-review on expiry: confirm openpgp still unimported before renewing." + +[[IgnoredVulns]] +id = "GO-2026-6354" +# CVE-2026-78662 is a denial of service in golang.org/x/crypto/ssh. +# The driver does not import ssh: `go list -buildvcs=false -deps -test ./...` +# resolves only golang.org/x/crypto/pbkdf2. There is no official v0.55.x +# backport; the first fixed release (v0.56.0) requires Go 1.26 and would raise +# the supported Go floor for code that cannot reach the vulnerable package. +ignoreUntil = 2027-03-09 +reason = "golang.org/x/crypto/ssh is not imported by this driver or its tests (verified via go list -deps -test); only x/crypto/pbkdf2 is reachable. Re-review on expiry: confirm ssh remains unimported before renewing." + +[[IgnoredVulns]] +id = "GO-2026-6355" +# CVE-2026-56855 is a denial of service in golang.org/x/crypto/ssh. +# The driver does not import ssh: `go list -buildvcs=false -deps -test ./...` +# resolves only golang.org/x/crypto/pbkdf2. There is no official v0.55.x +# backport; the first fixed release (v0.56.0) requires Go 1.26 and would raise +# the supported Go floor for code that cannot reach the vulnerable package. +ignoreUntil = 2027-03-09 +reason = "golang.org/x/crypto/ssh is not imported by this driver or its tests (verified via go list -deps -test); only x/crypto/pbkdf2 is reachable. Re-review on expiry: confirm ssh remains unimported before renewing."