fix(deps): update module github.com/go-viper/mapstructure/v2 to v2.3.0 [security] - abandoned

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/go-viper/mapstructure/v2	v2.1.0 -> v2.3.0

GitHub Vulnerability Alerts

GHSA-fv92-fjc5-jj9h

Summary

Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.

Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure as follows:

https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50

			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}

where this calls mapstructure.WeakDecode(...): https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil

Notably, WeakDecode(...) eventually calls one of the decode helpers, which surfaces the original value:

https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L679-L686

https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L726-L730

https://github.com/go-viper/mapstructure/blob/1a66224d5e54d8757f63bd66339cf764c3292c21/mapstructure.go#L783-L787

& more.

PoC

To reproduce with OpenBao:

$ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300

and in a new tab:

$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf"
{"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]}

Impact

This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at '' expected a map, got 'string' -- when the field type is string and a map is provided, we see the above information leak -- the previous example had a map type field with a string value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

---

Release Notes

go-viper/mapstructure (github.com/go-viper/mapstructure/v2)

v2.3.0

Compare Source

What's Changed

• build(deps): bump actions/checkout from 4.1.7 to 4.2.0 by @​dependabot in https://github.com/go-viper/mapstructure/pull/46
• build(deps): bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by @​dependabot in https://github.com/go-viper/mapstructure/pull/47
• [enhancement] Add check for reflect.Value in ComposeDecodeHookFunc by @​mahadzaryab1 in https://github.com/go-viper/mapstructure/pull/52
• build(deps): bump actions/setup-go from 5.0.2 to 5.1.0 by @​dependabot in https://github.com/go-viper/mapstructure/pull/51
• build(deps): bump actions/checkout from 4.2.0 to 4.2.2 by @​dependabot in https://github.com/go-viper/mapstructure/pull/50
• build(deps): bump actions/setup-go from 5.1.0 to 5.2.0 by @​dependabot in https://github.com/go-viper/mapstructure/pull/55
• build(deps): bump actions/setup-go from 5.2.0 to 5.3.0 by @​dependabot in https://github.com/go-viper/mapstructure/pull/58
• ci: add Go 1.24 to the test matrix by @​sagikazarmark in https://github.com/go-viper/mapstructure/pull/74
• build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.5.0 by @​dependabot in https://github.com/go-viper/mapstructure/pull/72
• build(deps): bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by @​dependabot in https://github.com/go-viper/mapstructure/pull/76
• build(deps): bump actions/setup-go from 5.3.0 to 5.4.0 by @​dependabot in https://github.com/go-viper/mapstructure/pull/78
• feat: add decode hook for netip.Prefix by @​tklauser in https://github.com/go-viper/mapstructure/pull/85
• Updates by @​sagikazarmark in https://github.com/go-viper/mapstructure/pull/86
• build(deps): bump github/codeql-action from 2.13.4 to 3.28.15 by @​dependabot in https://github.com/go-viper/mapstructure/pull/87
• build(deps): bump actions/setup-go from 5.4.0 to 5.5.0 by @​dependabot in https://github.com/go-viper/mapstructure/pull/93
• build(deps): bump github/codeql-action from 3.28.15 to 3.28.17 by @​dependabot in https://github.com/go-viper/mapstructure/pull/92
• build(deps): bump github/codeql-action from 3.28.17 to 3.28.19 by @​dependabot in https://github.com/go-viper/mapstructure/pull/97
• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @​dependabot in https://github.com/go-viper/mapstructure/pull/96
• Update README.md by @​peczenyj in https://github.com/go-viper/mapstructure/pull/90
• Add omitzero tag. by @​Crystalix007 in https://github.com/go-viper/mapstructure/pull/98
• Use error structs instead of duplicated strings by @​m1k1o in https://github.com/go-viper/mapstructure/pull/102
• build(deps): bump github/codeql-action from 3.28.19 to 3.29.0 by @​dependabot in https://github.com/go-viper/mapstructure/pull/101
• feat: add common error interface by @​sagikazarmark in https://github.com/go-viper/mapstructure/pull/105
• update linter by @​sagikazarmark in https://github.com/go-viper/mapstructure/pull/106
• Feature allow unset pointer by @​rostislaved in https://github.com/go-viper/mapstructure/pull/80

New Contributors

• @​tklauser made their first contribution in https://github.com/go-viper/mapstructure/pull/85
• @​peczenyj made their first contribution in https://github.com/go-viper/mapstructure/pull/90
• @​Crystalix007 made their first contribution in https://github.com/go-viper/mapstructure/pull/98
• @​rostislaved made their first contribution in https://github.com/go-viper/mapstructure/pull/80

Full Changelog: go-viper/mapstructure@v2.2.1...v2.3.0

v2.2.1

Compare Source

What's Changed

• Pass appropriate empty Value to hooks by @​yurishkuro in https://github.com/go-viper/mapstructure/pull/45

New Contributors

• @​yurishkuro made their first contribution in https://github.com/go-viper/mapstructure/pull/45

Full Changelog: go-viper/mapstructure@v2.2.0...v2.2.1

v2.2.0

Compare Source

What's Changed

• feat(decoder-configs): add flag to force decoding nil input in decoder config by @​mahadzaryab1 in https://github.com/go-viper/mapstructure/pull/42
• Add decode hooks for *url.URL by @​einzigartigerName in https://github.com/go-viper/mapstructure/pull/41

New Contributors

• @​mahadzaryab1 made their first contribution in https://github.com/go-viper/mapstructure/pull/42
• @​einzigartigerName made their first contribution in https://github.com/go-viper/mapstructure/pull/41

Full Changelog: go-viper/mapstructure@v2.1.0...v2.2.0

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.