fix(deps): update github (patch)#208
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/patch-github
branch
3 times, most recently
from
May 12, 2026 10:43
150d529 to
02408fb
Compare
renovate
Bot
force-pushed
the
renovate/patch-github
branch
2 times, most recently
from
May 13, 2026 20:44
98277c6 to
31f51f3
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/patch-github
branch
from
May 14, 2026 01:01
31f51f3 to
e0c97bb
Compare
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
Bot
force-pushed
the
renovate/patch-github
branch
2 times, most recently
from
May 18, 2026 11:14
67c8db1 to
895ce71
Compare
renovate
Bot
force-pushed
the
renovate/patch-github
branch
from
June 8, 2026 04:07
895ce71 to
a57d67c
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
renovate
Bot
force-pushed
the
renovate/patch-github
branch
from
June 20, 2026 08:02
a57d67c to
314781f
Compare
renovate
Bot
force-pushed
the
renovate/patch-github
branch
from
July 1, 2026 23:45
314781f to
9649cf0
Compare
renovate
Bot
force-pushed
the
renovate/patch-github
branch
from
July 19, 2026 13:29
9649cf0 to
91720c0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.5.1→v1.5.2v4.1.3→v4.1.5v10.30.2→v10.30.3v0.36.2→v0.36.3v1.4.1→v1.4.2v3.27.1→v3.27.2v1.21.0→v1.21.12.7.0→2.7.2Release Notes
ThreeDotsLabs/watermill (github.com/ThreeDotsLabs/watermill)
v1.5.2Compare Source
What's Changed
New Contributors
Full Changelog: ThreeDotsLabs/watermill@v1.5.1...v1.5.2
ThreeDotsLabs/watermill-sql (github.com/ThreeDotsLabs/watermill-sql/v4)
v4.1.5Compare Source
What's Changed
New Contributors
Full Changelog: ThreeDotsLabs/watermill-sql@v4.1.4...v4.1.5
v4.1.4Compare Source
What's Changed
New Contributors
Full Changelog: ThreeDotsLabs/watermill-sql@v4.1.3...v4.1.4
go-playground/validator (github.com/go-playground/validator/v10)
v10.30.3Compare Source
What's Changed
New Contributors
Full Changelog: go-playground/validator@v10.30.2...v10.30.3
meilisearch/meilisearch-go (github.com/meilisearch/meilisearch-go)
v0.36.3: 🐹Compare Source
🚀 Enhancements
🐛 Bug Fixes
Thanks again to @ElyarSadig, @ja7ad and @mvanhorn! 🎉
oapi-codegen/runtime (github.com/oapi-codegen/runtime)
v1.4.2: Bug fix for required parametersCompare Source
This is a bug fix to address a regression introduced in oapi-codegen v2.7.0
🐛 Bug fixes
Sponsors
We would like to thank our sponsors for their support during this release.
pressly/goose (github.com/pressly/goose/v3)
v3.27.2Compare Source
Changed
golang.org/x/cryptoandgolang.org/x/netto address security advisories (CVE fixes)samber/slog-gin (github.com/samber/slog-gin)
v1.21.1Compare Source
Filtersuffix operationsFilterperformanceOther
Full Changelog: samber/slog-gin@v1.21.0...v1.21.1
oapi-codegen/oapi-codegen (go:github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen)
v2.7.2: More fixes for code injection issuesCompare Source
String escaping fixes due to more code injection issues
We've had two more code injection issues reported in
oapi-codegen, thanks @Gal3M, @mrostamipoor for these findings.These specific issues are now patches in the main branch and in this v2.7.2 release.
You shouldn't blindly trust OpenAPI specs
This code wasn't originally written assuming code generation from random specs from the internet, and it never took any measures to protect itself from malicious specifications, the assumption being that you control your specification, and that you actually look over generated code.
For example, all these RCE exploits rely on using the package
init()function in the generated code to run some malicious code at package startup. A way to test for this is to see whether aninit()function is emitted, which we currently don't do.When working with OpenAPI specifications, especially specs you find on remote servers, you should download the spec locally, run some kind of spec validator on it, like openapi-spec-validator, and only then feed it into oapi-codegen. We're very permissive in accepting broken specifications, intentionally, since people feed a lot of garbage input, but this flexibility also makes us weak to these kinds of attacks. There are hundreds of injection sites in
oapi-codegenbased on my survey.For the next minor release,
v2.8.0, we're going to validate the spec before code generation (#2435), however, since this introduces a new set of failure modes, I don't want to include it in a maintenance release version. The future release is resilient against many forms of injection, and the spec validation has the added benefit that it can generate meaningful error messages for garbage input, where currently, we generate non-compiling code.Until then, please do sanity checks on your input specifications, on the generated output, and don't fetch specs from the internet in your build, commit both the spec locally into your source control, and go through code review. In our repo, we've hooked up Greptile to catch issues like this, and you should also use some code quality tool. We can't possibly protect against every kind of attack with simple heuristics.
Sponsors
We would like to thank our sponsors for their support during this release.
We'd also like to thank Greptile for allowing our project to use their code review system.
v2.7.1: Security fix for Go code injectionCompare Source
This is a security fix for a code injection vulnerability in v2.7.0, please see:
GHSA-rjwr-m7qx-3fjr
We're more strict about escaping strings passed into the OpenAPI specification, so that people can't inject Go code into generated code.
The problem was that it was possible to craft a description for server URL's which would emit arbitrary Go code, so if an attacker controlled your specification, they could inject Go code into your generated code which could do something malicious.
Configuration
📅 Schedule: (in timezone Asia/Ho_Chi_Minh)
* 1-18 * * 3,0)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.