Skip to content

Update module gopkg.in/evanphx/json-patch.v4 to v5 #319

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
red-hat-konflux wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −1
Open

Update module gopkg.in/evanphx/json-patch.v4 to v5 #319

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ require (
google.golang.org/genproto/googleapis/api v0.0.0-20260715232425-e75dac1f907d // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/evanphx/json-patch.v5 v5.9.11 // indirect

@coderabbitai coderabbitai Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

go mod verify
go list -m all
govulncheck ./...

Repository: openshift/lightspeed-agentic-operator

Length of output: 386

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod excerpt =="
nl -ba go.mod | sed -n '88,104p'

echo
echo "== go.sum entries for json-patch =="
rg -n 'evanphx/json-patch|gomodules.xyz/jsonpatch' go.sum || true

echo
echo "== module graph entries =="
go list -m all | rg 'evanphx/json-patch|gomodules.xyz/jsonpatch' || true

echo
echo "== go mod download info =="
go mod download -json gopkg.in/evanphx/json-patch.v5@v5.9.11 2>/dev/null | sed -n '1,80p' || true

Repository: openshift/lightspeed-agentic-operator

Length of output: 236

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== search usages =="
rg -n 'json-patch|jsonpatch' . --glob '!go.sum' --glob '!vendor/**' || true

Repository: openshift/lightspeed-agentic-operator

Length of output: 888

🌐 Web query:

gopkg.in/evanphx/json-patch.v5 v5.9.11 OSV vulnerability

💡 Result:

As of July 17, 2026, there are no security vulnerabilities associated with version v5.9.11 of the package gopkg.in/evanphx/json-patch.v5 (now primarily distributed via github.com/evanphx/json-patch/v5) [1][2][3]. Official vulnerability databases, including the Go Vulnerability Database, do not list any security advisories for version v5.9.11 [1][4][5]. The only prominent historical vulnerability for the evanphx/json-patch library is GO-2021-0076 (CVE-2018-14632), which affected much older versions of the package and was patched in 2018 [4][5][6]. Version v5.9.11, released on January 28, 2025, primarily introduced non-security updates, such as exporting error types and removing dependencies on unmaintained packages [7][8][9][10]. If your security scanning tools are flagging this version, it is likely a false positive or a misidentification of older, unrelated issues [11].

Citations:

🏁 Script executed (no clone):

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import json, urllib.request
payload = {
  "package": {"ecosystem": "Go", "name": "gopkg.in/evanphx/json-patch.v5"},
  "version": "v5.9.11"
}
req = urllib.request.Request(
    "https://api.osv.dev/v1/query",
    data=json.dumps(payload).encode(),
    headers={"Content-Type": "application/json"},
)
with urllib.request.urlopen(req, timeout=20) as resp:
    data = json.load(resp)
print(json.dumps(data, indent=2)[:12000])
PY

Length of output: 2720

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod around line 97 =="
sed -n '90,100p' go.mod

echo
echo "== go.sum matches =="
rg -n 'evanphx/json-patch|gomodules.xyz/jsonpatch' go.sum || true

echo
echo "== module metadata =="
go mod download -json gopkg.in/evanphx/json-patch.v5@v5.9.11 | sed -n '1,120p'

Repository: openshift/lightspeed-agentic-operator

Length of output: 2323

Add the matching go.sum entry for gopkg.in/evanphx/json-patch.v5 v5.9.11
go.mod pins the module, but go.sum does not yet include its checksum entry.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 97, Add the missing checksum entry for
gopkg.in/evanphx/json-patch.v5 v5.9.11 to go.sum, matching the dependency
version declared in go.mod.

Source: Path instructions

gopkg.in/inf.v0 v0.9.1 // indirect
k8s.io/klog/v2 v2.140.0 // indirect
k8s.io/kube-openapi v0.0.0-20260706235625-cdb1db5517a0 // indirect
Expand Down