fix: patch Snyk vulnerabilities and upgrade dependencies#96
Merged
Conversation
The Snyk policy file used slashes in license vuln IDs (e.g. github.com/hashicorp/hcl/v2) but Snyk matches against colon-separated IDs (github.com:hashicorp:hcl:v2). This caused all four HashiCorp MPL-2.0 license ignores to silently fail. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fixes SNYK-GOLANG-STDARCHIVETAR-15928858 (CVE Allocation of Resources Without Limits, CWE-770, CVSS 6.9). The vulnerability in std/archive/tar is resolved in Go 1.26.2. go mod tidy dropped go-jose/v4 and golang.org/x/crypto pins as they are not direct dependencies of the root module — existing .snyk safety-net ignores cover these. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Updates genproto/googleapis/rpc from 20260401 to 20260413 snapshot in both root and _examples modules. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
| Status | Scan Engine |  Critical |
 High |
 Medium |
 Low |
Total (0) |
|---|---|---|---|---|---|---|
| Open Source Security | 0 | 0 | 0 | 0 | See details | |
| Licenses | 0 | 0 | 0 | 0 | See details |
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.
There was a problem hiding this comment.
Pull request overview
Updates security tooling and Go dependencies to address reported Snyk issues and keep the module graph current.
Changes:
- Fix
.snykHashiCorp MPL-2.0 license ignore IDs to use colon-separated coordinates. - Upgrade the workspace/modules to Go
1.26.2. - Bump
google.golang.org/genproto/googleapis/rpcsnapshot (root +_examples) and refresh sums (including dropping unused indirect sums).
Reviewed changes
Copilot reviewed 4 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
go.work |
Bumps workspace Go version to 1.26.2. |
go.mod |
Bumps Go version, updates indirect genproto snapshot, and removes no-longer-required indirect pins. |
go.sum |
Reflects tidy/module graph changes (drops unused sums; updates genproto sums). |
_examples/go.mod |
Bumps Go version and indirect genproto snapshot in example module. |
_examples/go.sum |
Updates genproto sums for example module. |
.snyk |
Fixes license ignore IDs for HashiCorp transitive dependencies. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The two CVE-2026-39882 ignore entries had typos that caused them to silently fail: - Missing 'O' in package path: IOTEL → IOOTEL (go.opentelemetry.io/otel produces IO + OTEL = IOOTEL) - Wrong ID number on trace entry: 15954195 → 15954196 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The go.mod pins for go-jose/v4 and golang.org/x/crypto were dropped by go mod tidy during the Go 1.26.2 upgrade. Update the ignore reason text to accurately reflect these are transitive ghost deps not listed in go.mod, rather than claiming they are "fixed via go.mod pin". Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates dependency/tooling metadata to address reported Snyk findings by correcting .snyk ignore identifiers and upgrading the Go toolchain/dependency set so that security and license ignores apply as intended.
Changes:
- Bump Go version declarations from
1.26.1to1.26.2across the workspace/modules. - Update indirect dependency
google.golang.org/genproto/googleapis/rpcto a newer snapshot (and refreshgo.sumfiles). - Fix
.snykignore IDs (HashiCorp MPL-2.0 license IDs and OpenTelemetry exporter vulnerability IDs) so Snyk matching doesn’t silently fail.
Reviewed changes
Copilot reviewed 4 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
go.work |
Updates workspace Go version to 1.26.2. |
go.mod |
Updates Go version, removes now-unneeded indirect pins, bumps genproto snapshot. |
go.sum |
Reflects go mod tidy results and the genproto snapshot bump. |
_examples/go.mod |
Updates example module Go version and aligns genproto snapshot. |
_examples/go.sum |
Updates sums for the genproto snapshot bump. |
.snyk |
Corrects ignore identifiers for license/vulnerability entries so ignores match properly. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
corvramirez
approved these changes
Apr 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github.com/hashicorp/...) in the Snyk ID but Snyk matches against colon-separated IDs (github.com:hashicorp:...), causing ignores to silently fail.IOTELinstead ofIOOTEL) and the trace entry had the wrong ID number (15954195→15954196), causing these High-severity ignores to silently fail.SNYK-GOLANG-STDARCHIVETAR-15928858— Allocation of Resources Without Limits (CVSS 6.9) instd/archive/tar.google.golang.org/genproto: Updates indirect dep to latest snapshot (20260401 → 20260413) in both modules.Commits
01cb4dffc06cf64baad82a70998aVerification
snyk test --org=flumepasses with 0 vulnerabilities for bothgo.modand_examples/go.modgo test ./andcd _examples && go test ./.both passNotes
go mod tidydroppedgo-jose/v4andgolang.org/x/cryptopins from rootgo.modsince they are not direct dependencies — existing.snyksafety-net ignores cover these.🤖 Generated with Claude Code