Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 1 addition & 7 deletions .github/workflows/security-scan.yml
Original file line number Diff line number Diff line change
Expand Up @@ -57,12 +57,6 @@ jobs:
- name: Check for vulnerabilities (with exclusions)
run: |
# Ignored vulnerabilities with justification:
# GO-2025-4192: sigstore/timestamp-authority excessive memory allocation (CVE-2025-66564)
# Indirect dependency via sigstore-go (used for container signature verification).
# The vulnerability affects timestamp-authority server request parsing endpoints.
# ToolHive only uses sigstore-go as a client to verify signatures, it does not
# expose any timestamp-authority server endpoints. Fix requires sigstore-go to
# upgrade to timestamp-authority/v2 which hasn't been released yet.
# GO-2026-4514: buger/jsonparser Delete function DoS via malformed JSON (CVE-2025-54410)
# Indirect dependency via mcp-go, invopop/jsonschema, wk8/go-ordered-map.
# The vulnerability is in the Delete function which is not called by ToolHive
Expand All @@ -78,7 +72,7 @@ jobs:
# Docker client SDK and does not run or configure AuthZ plugins. No fixed version
# exists for github.com/docker/docker; fix is only in github.com/moby/moby/v2
# v2.0.0-beta.8+ which is not yet available as a docker/docker release.
IGNORED_VULNS="GO-2025-4192 GO-2026-4514 GO-2026-4883 GO-2026-4887"
IGNORED_VULNS="GO-2026-4514 GO-2026-4883 GO-2026-4887"

# Show the raw output for debugging
echo "::group::govulncheck raw output"
Expand Down
50 changes: 24 additions & 26 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -144,29 +144,29 @@ require (
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
github.com/go-logr/zapr v1.3.0 // indirect
github.com/go-ole/go-ole v1.2.6 // indirect
github.com/go-openapi/analysis v0.24.1 // indirect
github.com/go-openapi/errors v0.22.6 // indirect
github.com/go-openapi/jsonpointer v0.22.4 // indirect
github.com/go-openapi/jsonreference v0.21.4 // indirect
github.com/go-openapi/loads v0.23.2 // indirect
github.com/go-openapi/runtime v0.29.2 // indirect
github.com/go-openapi/spec v0.22.3 // indirect
github.com/go-openapi/strfmt v0.25.0 // indirect
github.com/go-openapi/swag v0.25.4 // indirect
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
github.com/go-openapi/swag/conv v0.25.4 // indirect
github.com/go-openapi/swag/fileutils v0.25.4 // indirect
github.com/go-openapi/swag/jsonname v0.25.4 // indirect
github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
github.com/go-openapi/swag/loading v0.25.4 // indirect
github.com/go-openapi/swag/mangling v0.25.4 // indirect
github.com/go-openapi/swag/netutils v0.25.4 // indirect
github.com/go-openapi/swag/stringutils v0.25.4 // indirect
github.com/go-openapi/swag/typeutils v0.25.4 // indirect
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
github.com/go-openapi/validate v0.25.1 // indirect
github.com/go-openapi/analysis v0.24.3 // indirect
github.com/go-openapi/errors v0.22.7 // indirect
github.com/go-openapi/jsonpointer v0.22.5 // indirect
github.com/go-openapi/jsonreference v0.21.5 // indirect
github.com/go-openapi/loads v0.23.3 // indirect
github.com/go-openapi/runtime v0.29.3 // indirect
github.com/go-openapi/spec v0.22.4 // indirect
github.com/go-openapi/strfmt v0.26.1 // indirect
github.com/go-openapi/swag v0.25.5 // indirect
github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
github.com/go-openapi/swag/conv v0.25.5 // indirect
github.com/go-openapi/swag/fileutils v0.25.5 // indirect
github.com/go-openapi/swag/jsonname v0.25.5 // indirect
github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
github.com/go-openapi/swag/loading v0.25.5 // indirect
github.com/go-openapi/swag/mangling v0.25.5 // indirect
github.com/go-openapi/swag/netutils v0.25.5 // indirect
github.com/go-openapi/swag/stringutils v0.25.5 // indirect
github.com/go-openapi/swag/typeutils v0.25.5 // indirect
github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
github.com/go-openapi/validate v0.25.2 // indirect
github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
github.com/gobuffalo/pop/v6 v6.1.1 // indirect
github.com/gobwas/glob v0.2.3 // indirect
github.com/godbus/dbus/v5 v5.2.2 // indirect
Expand Down Expand Up @@ -219,7 +219,6 @@ require (
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
github.com/ncruces/go-strftime v1.0.0 // indirect
github.com/nyaruka/phonenumbers v1.6.12 // indirect
github.com/oklog/ulid v1.3.1 // indirect
github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
github.com/olekukonko/errors v1.2.0 // indirect
github.com/olekukonko/ll v0.1.6 // indirect
Expand All @@ -245,9 +244,9 @@ require (
github.com/sigstore/protobuf-specs v0.5.1 // indirect
github.com/sigstore/rekor v1.5.0 // indirect
github.com/sigstore/rekor-tiles/v2 v2.0.1 // indirect
github.com/sigstore/sigstore v1.10.4 // indirect
github.com/sigstore/sigstore v1.10.5 // indirect
github.com/sigstore/sigstore-go v1.1.4 // indirect
github.com/sigstore/timestamp-authority/v2 v2.0.3 // indirect
github.com/sigstore/timestamp-authority/v2 v2.0.6 // indirect
github.com/sirupsen/logrus v1.9.4 // indirect
github.com/skeema/knownhosts v1.3.1 // indirect
Comment on lines +247 to 251
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 The govulncheck suppression for GO-2025-4192 in .github/workflows/security-scan.yml has a stale justification comment claiming 'Fix requires sigstore-go to upgrade to timestamp-authority/v2 which hasn't been released yet,' but this PR upgrades timestamp-authority/v2 to v2.0.6, making the comment factually incorrect. The suppression entry (and ideally the comment) should be removed or updated to reflect the current state, and govulncheck should be run to verify whether the vulnerability is still triggered post-upgrade.

Extended reasoning...

What the bug is: The file .github/workflows/security-scan.yml line 81 contains IGNORED_VULNS="GO-2025-4192 GO-2026-4514 GO-2026-4883 GO-2026-4887", suppressing the govulncheck report for GO-2025-4192 (CVE-2025-66564: excessive memory allocation in sigstore/timestamp-authority). Lines 60-65 of the same file contain a justification comment explaining the suppression: 'Fix requires sigstore-go to upgrade to timestamp-authority/v2 which hasn't been released yet.' This comment is now demonstrably stale.

The specific code path: This PR bumps github.com/sigstore/timestamp-authority/v2 from v2.0.3 to v2.0.6 in go.mod (line 247). The go.mod and go.sum diffs confirm that the old v1 module dependency has been fully removed (e.g., github.com/oklog/ulid v1.3.1 and go.mongodb.org/mongo-driver v1.17.6 are gone, replaced by github.com/oklog/ulid/v2 v2.1.1), and go.sum now only contains github.com/sigstore/timestamp-authority/v2 v2.0.6. The transition to v2 that the suppression comment was waiting for has clearly already happened.

Why existing code doesn't prevent it: The IGNORED_VULNS list in security-scan.yml is a manual allowlist. There is no automated mechanism to detect when a suppression becomes stale—developers must track these manually. Dependabot-generated PRs like this one do not touch the security-scan.yml workflow, so the stale suppression was naturally left behind.

Concrete proof: (1) The suppression comment says 'hasn't been released yet,' but the project was already on timestamp-authority/v2 v2.0.3 before this PR. (2) This PR upgrades it further to v2.0.6. (3) The vulnerability GO-2025-4192 is in timestamp-authority v1 (excessive memory allocation in server-side request parsing). Since the project is now fully on v2, the original rationale is resolved. (4) The 'hasn't been released yet' claim was already inaccurate at commit a388093 when the suppression was added, and is even more clearly wrong after this PR.

Impact: The stale comment ('which hasn't been released yet') actively misleads developers into believing the upstream fix is still pending. Additionally, if GO-2025-4192 is truly fixed by the v2 upgrade, keeping the suppression means govulncheck will not alert if this vulnerability is somehow re-introduced. The practical security risk is mitigated by the fact that ToolHive only uses timestamp-authority as a client (via sigstore-go) and does not expose the vulnerable server endpoints—so the suppression may still be technically valid even if the comment is wrong.

How to fix: Remove GO-2025-4192 from the IGNORED_VULNS list in .github/workflows/security-scan.yml line 81, and delete the associated justification comment at lines 60-65. Run govulncheck locally after the upgrade to confirm whether GO-2025-4192 is still triggered. If it is still flagged (due to a reachable code path), add a fresh, accurate comment explaining the current rationale for the suppression.

github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
Expand All @@ -274,7 +273,6 @@ require (
github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
github.com/yuin/gopher-lua v1.1.1 // indirect
github.com/yusufpapurcu/wmi v1.2.4 // indirect
go.mongodb.org/mongo-driver v1.17.6 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 // indirect
go.opentelemetry.io/contrib/propagators/b3 v1.21.0 // indirect
go.opentelemetry.io/contrib/propagators/jaeger v1.21.1 // indirect
Expand Down
Loading
Loading