fix(deps): bump golang-jwt/jwt/v4 to v4.5.2 - #535
Merged
Conversation
Raises the indirect dependency past two advisories: - CVE-2025-30204 (HIGH): excessive memory allocation while parsing a JWT header. Fixed in 4.5.2. - CVE-2024-51744 (LOW): ParseWithClaims error handling is documented in a way that invites mishandling. Fixed in 4.5.1. The dependency reaches the agent binary through the Delinea DSV backend added in #532: agent/secretsmgr -> DelineaXPM/dsv-sdk-go/v2 -> Azure/go-autorest autorest/adal -> golang-jwt/jwt/v4. Every requirer in that chain pins v4.5.0, so raising our own floor is what moves the selected version; no upstream release is needed, since minimal version selection takes the maximum required and 4.5.2 is a patch within the same minor. Confirmed the whole suite passes. Note that agent/secretsmgr is intermittently flaky, independent of this change: it failed once on the bumped tree and then passed on three consecutive re-runs, while the same test also passes on an unmodified develop. The package polls with real timers over roughly 30 to 40 seconds, which is the likely cause. Flagging it rather than folding a test fix into a dependency bump. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
leoparente
marked this pull request as ready for review
August 13, 2026 17:14
leoparente
requested review from
MicahParks,
davidlanouette,
grant-nbl,
jajeffries,
manrodrigues,
mfiedorowicz,
paulstuart and
samiura
as code owners
August 13, 2026 17:14
manrodrigues
approved these changes
Aug 13, 2026
|
Go test coverage
Total coverage: 75.2% |
Vulnerability Scan: Failed — blocking vulnerabilities detectedImage:
Commit: 7df9578 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the indirect dependency
github.com/golang-jwt/jwt/v4from v4.5.0 to v4.5.2, clearing two advisories flagged by the container scan against/usr/local/bin/orb-agent.v4.5.2 covers both.
Where it comes from
It is not a direct dependency.
go mod whygives the chain:So it arrived with the Delinea DSV backend in #532. Every requirer pins v4.5.0 —
dsv-sdk-go v2.2.0,go-autorest v0.11.29,azure/auth v0.5.13— which is why the vulnerable version was selected.Why a floor bump is sufficient
Minimal version selection takes the maximum version required across the graph, so an explicit requirement in our own
go.modraises the selected version without waiting on any upstream release. v4.5.2 is a patch within the same minor as what every requirer asks for, so no API change is involved.Diff is one line in
go.modand one net line ingo.sum.Verification
go build ./...cleango test ./... -count=1fully green on the bumped treeA flaky test worth knowing about, unrelated to this change
agent/secretsmgrfailed once on the bumped tree and then passed on three consecutive re-runs. The same package also passes on an unmodifieddevelop. It polls with real timers over roughly 30 to 40 seconds and logs a deliberate 404 path during the run, which is the likely source.I checked this specifically because a single failure right after a dependency bump looks like causation, and it is not: the failure does not reproduce, and the clean tree is not immune. Deliberately not folding a test fix into a dependency bump, but it is worth its own issue if it recurs in CI.
Note on the other scan findings
This does not touch the two Python advisories that currently fail
Build & Scan—msgpackandsetuptools. Both are pip's own vendored copies rather than project dependencies, so no dependency change in this repo reaches them; they need either dropping the runtime pip from the final image or a documented suppression. Separate piece of work.🤖 Generated with Claude Code