Skip to content

fix(deps): vuln minor upgrades — 4 packages (minor: 2 · patch: 2) - #3361

Draft
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/0-1786958178
Draft

fix(deps): vuln minor upgrades — 4 packages (minor: 2 · patch: 2) #3361
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/0-1786958178

Conversation

@gh-worker-campaigns-3e9aa4

Copy link
Copy Markdown
Contributor

Summary: High-severity security update — 4 packages upgraded (MINOR changes included)

Manifests changed:

  • . (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.


Updates

Package From To Type Dep Type Vulnerabilities Fixed
oras.land/oras-go/v2 v2.6.0 v2.6.2 patch Transitive 6 HIGH, 5 MEDIUM, 3 LOW
golang.org/x/crypto v0.53.0 v0.55.0 minor Transitive 1 UNKNOWN
golang.org/x/mod v0.37.0 v0.40.0 minor Transitive 2 UNKNOWN
github.com/klauspost/compress v1.18.4 v1.18.7 patch Transitive 1 UNKNOWN

Security Details

🚨 Critical & High Severity (6 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
oras.land/oras-go/v2 GO-2026-5880 HIGH Hardlink path traversal during tar extraction in oras.land/oras-go v2.6.0 2.6.2 -
oras.land/oras-go/v2 GHSA-fxhp-mv3v-67qp HIGH oras-go tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution v2.6.0 2.6.2 -
oras.land/oras-go/v2 CVE-2026-50163 HIGH oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in oras-go tar extraction v2.6.0 - -
oras.land/oras-go/v2 GO-2026-5882 HIGH Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go v2.6.0 2.6.1 -
oras.land/oras-go/v2 GHSA-jxpm-75mh-9fp7 HIGH oras-go blob upload vulnerable to credential forwarding via unvalidated Location header v2.6.0 2.6.1 -
oras.land/oras-go/v2 CVE-2026-50151 HIGH oras-go: credential forwarding via unvalidated Location header in blob upload v2.6.0 - -
ℹ️ Other Vulnerabilities (12)
Package CVE Severity Summary Unsafe Version Fixed In Case
oras.land/oras-go/v2 GHSA-8xwf-rjm4-xvhv MODERATE oras-go has file store write outside workingDir via symlink traversal v2.6.0 2.6.1 -
oras.land/oras-go/v2 CVE-2026-50162 MODERATE oras-go: file store write outside workingDir via symlink traversal v2.6.0 - -
oras.land/oras-go/v2 GO-2026-5879 MODERATE Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go v2.6.0 2.6.1 -
oras.land/oras-go/v2 GHSA-vh4v-2xq2-g5cg MODERATE ORAS Go forwards registry credentials across registry redirects v2.6.0 2.6.1 -
oras.land/oras-go/v2 GO-2026-5884 MODERATE ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go v2.6.0 2.6.1 -
oras.land/oras-go/v2 GHSA-xf85-363p-868w LOW oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens v2.6.0 2.6.1 -
oras.land/oras-go/v2 GO-2026-5885 LOW Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go v2.6.0 2.6.1 -
oras.land/oras-go/v2 CVE-2026-48978 LOW oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens v2.6.0 - -
github.com/klauspost/compress GO-2026-5841 unknown OOB read in github.com/klauspost/compress/s2 v1.18.4 1.18.7 -
golang.org/x/crypto GO-2026-5932 unknown The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues v0.53.0 - -
golang.org/x/mod GO-2026-6180 unknown Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb v0.37.0 0.40.0 -
golang.org/x/mod GO-2026-6179 unknown Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog v0.37.0 0.40.0 -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@datadog-prod-us1-4

datadog-prod-us1-4 Bot commented Aug 17, 2026

Copy link
Copy Markdown

Pipelines  Code Coverage

Unblock PR with BitsAI

⚠️ Warnings

🚦 3 Pipeline jobs failed

DataDog/datadog-operator | check-golang-version — 🔧 Needs a code fix, caused by this PR

View in Datadog · View in GitLab

pull request linter | Check Milestone

View in Datadog · View in GitHub Actions

Missing milestone or qa/skip-qa label.

pull request linter | build

View in Datadog · View in GitHub Actions

Missing required labels for pull request. Valid labels are: 'bug', 'enhancement', 'refactoring', 'documentation', 'tooling', 'dependencies'.

ℹ️ Info

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 50.30% (+0.00%)

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 2bca816 | Docs | View more details | Give us feedback!

Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>
@gh-worker-campaigns-3e9aa4

Copy link
Copy Markdown
Contributor Author

Auto-rebase complete

Branch is up to date with main — rebased onto f0365d3.


Auto-Rebase · Add no-auto-rebase to opt out

@dd-octo-sts-4caf68
dd-octo-sts-4caf68 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/go/0-1786958178 branch from 520e77d to 2bca816 Compare August 18, 2026 13:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants