From 2b68f6f4371390f015d261657cb78edd481d1139 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Tue, 25 Aug 2026 14:33:04 +0000 Subject: [PATCH] Update gorilla/websocket to v1.5.3 GHSA-w67g-5rqw-f597: versions below v1.5.3 derive the WebSocket frame mask key from math/rand rather than a cryptographic source. The CLI links it through k8s.io/client-go's transport/websocket and tools/remotecommand, so it is reachable from the exec path. The dependency stays indirect and the Go directive is unchanged, so release builds keep the go1.25.13 toolchain pinned by #159. Ticket: https://github.com/StackVista/cve-reporter/issues/32 Finding revision: sha256:584c08ac7ac36342068919d81349c67b61457518511df9a00b23644728294094 Co-authored-by: Cve Ticket Reconciler --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index c554565c..ee1917a2 100644 --- a/go.mod +++ b/go.mod @@ -88,7 +88,7 @@ require ( github.com/fsnotify/fsnotify v1.7.0 // indirect github.com/golang/protobuf v1.5.4 // indirect github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect - github.com/gorilla/websocket v1.5.1 // indirect + github.com/gorilla/websocket v1.5.3 // indirect github.com/hashicorp/hcl v1.0.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/lithammer/fuzzysearch v1.1.8 // indirect diff --git a/go.sum b/go.sum index 1ccf4920..41aa1265 100644 --- a/go.sum +++ b/go.sum @@ -89,8 +89,8 @@ github.com/gookit/color v1.4.2/go.mod h1:fqRyamkC1W8uxl+lxCQxOT09l/vYfZ+QeiX3rKQ github.com/gookit/color v1.5.0/go.mod h1:43aQb+Zerm/BWh2GnrgOQm7ffz7tvQXEKV6BFMl7wAo= github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0= github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w= -github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY= -github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY= +github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= +github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA= github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA= github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=