Repository navigation
build(deps): bump github.com/go-playground/validator/v10 in /errors - #269
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
d98bc6e to
7cb52d5
Compare
|
@dependabot rebase |
40471a1 to
703acba
Compare
7a10257 to
8118a97
Compare
2c269b7 to
88b8f8d
Compare
enzo-wego
left a comment
enzo-wego
left a comment
There was a problem hiding this comment.
Blocking on the mimetype version this bump pulls in, details inline on errors/go.mod.
🤖 AI-assisted review via Claude Code
| github.com/Ardesco/credit-card-generator v0.0.0-20201208233833-a7202c328b75 // indirect | ||
| github.com/fsnotify/fsnotify v1.9.0 // indirect | ||
| github.com/gabriel-vasile/mimetype v1.4.8 // indirect | ||
| github.com/gabriel-vasile/mimetype v1.4.15 // indirect |
There was a problem hiding this comment.
This pulls mimetype v1.4.15, which is in the affected range of GHSA-jjmc-jx7j-hp68 (crafted doc/ppt/xls input burns CPU, fixed in v1.4.16). Nothing in this repo reaches it, but all 14 bumped modules would publish v1.4.15 as the minimum for their consumers, so consumer scanners will flag it.
Could we run go get github.com/gabriel-vasile/mimetype@v1.4.16 && go mod tidy in each bumped module before merging?
f88cf4c to
3681ea0
Compare
3681ea0 to
7339289
Compare
wego-automation
left a comment
wego-automation
left a comment
There was a problem hiding this comment.
Requesting changes on the mimetype floor already flagged inline: validator v10.30.5 requires mimetype v1.4.15, inside the GHSA-jjmc-jx7j-hp68 affected range (fixed in v1.4.16), so all 14 bumped modules publish a vulnerable minimum to consumers. go get github.com/gabriel-vasile/mimetype@v1.4.16 && go mod tidy in each bumped module clears it.
Two non-blocking notes for whenever this lands:
The bump is wider than the title's in /errors: all 14 module dirs move to validator v10.30.5, so every consumer that upgrades any of them picks up tag-semantic changes across v10.25.0..v10.30.5. Worth a tag sweep in services consuming these modules before upgrading: e164 accepts a missing + and rejects +0 codes, email must pass mail.ParseAddress, url rejects bare file://, bic retargets to ISO 9362:2022 (the old set moved to bic_iso_9362_2014), uuid is now case-insensitive, fqdn enforces the max DNS length, and required_if panics on duplicate field params.
.github/workflows/check.yml:111 gates the test run on find -maxdepth 1, so encryption's subdirectory tests never execute; this PR's green ran tests in 9 of the 14 touched modules (vet and revive ran in all 14).
🤖 AI-assisted review via Devin
7339289 to
f86c982
Compare
wego-automation
left a comment
wego-automation
left a comment
There was a problem hiding this comment.
Requesting changes: the mimetype blocker flagged inline on errors/go.mod still stands at f86c982. validator v10.30.5 floors github.com/gabriel-vasile/mimetype at v1.4.15, inside the GHSA-jjmc-jx7j-hp68 affected range (patched in v1.4.16), so all 14 bumped modules publish a vulnerable minimum to consumers. go get github.com/gabriel-vasile/mimetype@v1.4.16 && go mod tidy in each bumped module clears it.
🤖 AI-assisted review via Devin
f86c982 to
239553a
Compare
Bumps [github.com/go-playground/validator/v10](https://github.com/go-playground/validator) in `/errors` from 10.25.0 to 10.30.5. Updates `github.com/go-playground/validator/v10` from 10.25.0 to 10.30.5 - [Release notes](https://github.com/go-playground/validator/releases) - [Commits](go-playground/validator@v10.25.0...v10.30.5) Updates `github.com/go-playground/validator/v10` from 10.25.0 to 10.30.5 - [Release notes](https://github.com/go-playground/validator/releases) - [Commits](go-playground/validator@v10.25.0...v10.30.5) --- updated-dependencies: - dependency-name: github.com/go-playground/validator/v10 dependency-version: 10.30.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies/github.com/go-playground/validator/v10 - dependency-name: github.com/go-playground/validator/v10 dependency-version: 10.30.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies/github.com/go-playground/validator/v10 ... Signed-off-by: dependabot[bot] <support@github.com>
239553a to
ad3ec13
Compare
Bumps github.com/go-playground/validator/v10 in
/errorsfrom 10.25.0 to 10.30.5.Updates
github.com/go-playground/validator/v10from 10.25.0 to 10.30.5Release notes
Sourced from github.com/go-playground/validator/v10's releases.
... (truncated)
Commits
6a9b666docs: add AI agent attribution requirements to CONTRIBUTING.md (#1640)830a0b2Go 1.27 support (#1637)c7f3d2cfix: allow signed integer fields in port validation (#1633)dfe35cfci: Fix the linter version (#1617)facf128feat(translations): add Armenian translations (#1604)961375bdocs: clarify fieldexcludes behavior (#1610)74dd82atest: cover startsnotwith/endsnotwith, RegisterStructValidationMapRules, and ...379edc8chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#1612)f9944c5fix: use idiomatic "at most" in English max/lte messages (#1600)67e37d6fix(fqdn): enforce maximum DNS name length (#1603)Updates
github.com/go-playground/validator/v10from 10.25.0 to 10.30.5Release notes
Sourced from github.com/go-playground/validator/v10's releases.
... (truncated)
Commits
6a9b666docs: add AI agent attribution requirements to CONTRIBUTING.md (#1640)830a0b2Go 1.27 support (#1637)c7f3d2cfix: allow signed integer fields in port validation (#1633)dfe35cfci: Fix the linter version (#1617)facf128feat(translations): add Armenian translations (#1604)961375bdocs: clarify fieldexcludes behavior (#1610)74dd82atest: cover startsnotwith/endsnotwith, RegisterStructValidationMapRules, and ...379edc8chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#1612)f9944c5fix: use idiomatic "at most" in English max/lte messages (#1600)67e37d6fix(fqdn): enforce maximum DNS name length (#1603)