You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by "kezhenxu94 (via GitHub)" <gi...@apache.org> on 2026/08/03 07:34:50 UTC
[PR] cves: bump go-openapi/swag to v0.27.1, go-toml/v2 to v2.4.3 [skywalking-satellite]
kezhenxu94 opened a new pull request, #275:
URL: https://github.com/apache/skywalking-satellite/pull/275
Bumps two indirect dependencies that vulnerability scanners flag against the released satellite image.
| Severity | ID | Package | From | To |
|---|---|---|---|---|
| HIGH | XRAY-1032960 | `github.com/go-openapi/swag/jsonutils` | 0.25.5 | v0.27.1 |
| MEDIUM | XRAY-1032959 | `github.com/go-openapi/swag/yamlutils` | 0.25.5 | v0.27.1 |
| HIGH | XRAY-1033007 | `github.com/pelletier/go-toml/v2` | 2.2.4 | v2.4.3 |
The `swag` bump moves all `go-openapi/swag/*` submodules to v0.27.1 together and pulls `github.com/go-openapi/jsonpointer` up to v1.0.0 as a side effect, since the submodules require it.
`go mod tidy` and `go build ./...` both pass. No source changes were needed — these are indirect dependencies only.
/cc @kezhenxu94
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump go-openapi/swag to v0.27.1, go-toml/v2 to v2.4.3 [skywalking-satellite]
Posted by "kezhenxu94 (via GitHub)" <gi...@apache.org>.
kezhenxu94 commented on PR #275:
URL: https://github.com/apache/skywalking-satellite/pull/275#issuecomment-5164114076
Friendly ping @kezhenxu94 — this is a small indirect-dependency bump (`go-openapi/swag` → v0.27.1, `pelletier/go-toml/v2` → v2.4.3) to clear scanner findings against the released image. CI is green and `go build ./...` passes.
Unrelated but worth flagging while you're here: the `publish-docker` workflow has been failing with `startup_failure` on **every** run since 2026-07-01 — the last successful publish was `419d33d4` on 2026-06-19, so no new satellite images have reached `ghcr.io/apache/skywalking-satellite` in over a month. The workflow file itself hasn't changed since March and the pinned `docker/login-action` SHA still resolves, so it looks external to the repo (possibly an org-level Actions or `packages: write` policy change). Happy to open a separate issue if that's useful.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] cves: bump go-openapi/swag to v0.27.1, go-toml/v2 to v2.4.3 [skywalking-satellite]
Posted by "wu-sheng (via GitHub)" <gi...@apache.org>.
wu-sheng merged PR #275:
URL: https://github.com/apache/skywalking-satellite/pull/275
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org