[release-v0.78.x] Security: Fix CVE-2026-34986 (go-jose)

[jkhelil]

Changes

Remove the replace directive that pinned github.com/go-jose/go-jose/v4 to vulnerable v4.0.5, allowing the already-required v4.1.4 (the fixed version) to be used.

CVE Details:

• ID: CVE-2026-34986
• Package: github.com/go-jose/go-jose/v4
• Severity: Undefined (DoS — Denial of Service)
• Affected versions: < 4.1.4 and < 3.0.5
• Fixed version: v4.1.4
• Description: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object. Decrypting a JWE object with a key-wrapping algorithm and an empty encrypted_key field causes a panic in cipher.KeyUnwrap().

Fix Summary:

• Removed replace directive: github.com/go-jose/go-jose/v4 => github.com/go-jose/go-jose/v4 v4.0.5
• The require section already declared v4.1.4 // indirect — removing the replace directive allows the fixed version to take effect
• Ran go mod tidy && go mod verify && go mod vendor — all passed ✅

Test Results:

• go test ./... — timed out after 300s in sandbox environment
• All visible packages passed before timeout (large repo with many packages)
• ⚠️ Tests timed out — manual review of CI results recommended before merge

Breaking Changes: None — v4.1.4 is a patch release fixing the DoS panic

Risk Assessment: Low — removes a pinned replace directive that was actively downgrading a dependency to a vulnerable version

Jira References: SRVKP-12885

Submitter Checklist

• Run make test lint before submitting a PR
• Includes tests (dependency update — no new logic)
• Includes docs (not user-facing)
• Commit messages follow commit message best practices

Release Notes

Security: Update go-jose/v4 from v4.0.5 to v4.1.4 to fix CVE-2026-34986 (Denial of Service via crafted JWE object)

Co-Assisted-By: Claude Sonnet 4.6 noreply@anthropic.com

[jkhelil]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jkhelil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment