fix(security): update module github.com/go-viper/mapstructure/v2 to v2.4.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-viper/mapstructure/v2	v2.3.0 -> v2.4.0

GitHub Vulnerability Alerts

GHSA-2464-8j7c-4cjm

Summary

Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.

Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure as follows:

https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50

			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}

where this calls mapstructure.WeakDecode(...): https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil

Notably, WeakDecode(...) eventually calls one of the decode helpers, which surfaces the original value via strconv helpers:

https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L720-L727

https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L791-L798

https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/decode_hooks.go#L180

& more. These are different code paths than are fixed in the previous iteration at GHSA-fv92-fjc5-jj9h.

PoC

To reproduce with OpenBao:

$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300

and in a new tab:

$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf"

--> server logs:

2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\""

Impact

This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at '' expected a map, got 'string' -- when the field type is string and a map is provided, we see the above information leak -- the previous example had a map type field with a string value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

---

Release Notes

go-viper/mapstructure (github.com/go-viper/mapstructure/v2)

v2.4.0

Compare Source

What's Changed

• refactor: replace interface{} with any by @​sagikazarmark in https://github.com/go-viper/mapstructure/pull/115
• build(deps): bump github/codeql-action from 3.29.0 to 3.29.2 by @​dependabot[bot] inhttps://github.com/go-viper/mapstructure/pull/1144
• Generic tests by @​sagikazarmark in https://github.com/go-viper/mapstructure/pull/118
• Fix godoc reference link in README.md by @​peczenyj in https://github.com/go-viper/mapstructure/pull/107
• feat: add StringToTimeLocationHookFunc to convert strings to *time.Location by @​ErfanMomeniii in https://github.com/go-viper/mapstructure/pull/117
• feat: add back previous StringToSlice as a weak function by @​sagikazarmark in https://github.com/go-viper/mapstructure/pull/119

New Contributors

• @​ErfanMomeniii made their first contribution in https://github.com/go-viper/mapstructure/pull/117

Full Changelog: go-viper/mapstructure@v2.3.0...v2.4.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: flagd/go.sum

Command failed: go get -t ./...
go: downloading buf.build/gen/go/open-feature/flagd/connectrpc/go v1.18.1-20250529171031-ebdc14163473.1
go: downloading github.com/rs/xid v1.6.0
go: downloading github.com/stretchr/testify v1.10.0
go: downloading go.uber.org/mock v0.5.2
go: downloading github.com/gorilla/mux v1.8.1
go: downloading github.com/rs/cors v1.11.1
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0
go: downloading github.com/cpuguy83/go-md2man/v2 v2.0.6
go: downloading github.com/diegoholiveira/jsonlogic/v3 v3.8.4
go: downloading github.com/twmb/murmur3 v1.1.8
go: downloading github.com/zeebo/xxh3 v1.0.2
go: downloading golang.org/x/mod v0.25.0
go: downloading connectrpc.com/otelconnect v0.7.2
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/russross/blackfriday/v2 v2.1.0
go: downloading github.com/barkimedes/go-deepcopy v0.0.0-20220514131651-17c30cfc62df
go: downloading github.com/klauspost/cpuid/v2 v2.2.7
go: downloading go.opentelemetry.io/proto/otlp v1.7.0
go: downloading github.com/cenkalti/backoff/v5 v5.0.2
go: downloading github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1
go: downloading github.com/open-feature/flagd/core v0.12.1
go: downloading github.com/open-feature/flagd v0.4.2
go: github.com/open-feature/flagd/flagd/pkg/service/flag-evaluation imports
	github.com/open-feature/flagd/core/pkg/notifications: cannot find module providing package github.com/open-feature/flagd/core/pkg/notifications
go: warning: go.opentelemetry.io/otel/exporters/prometheus@v0.59.0: retracted by module author: v0.59.0 produces incorrect metric names when bracketed units are used.
go: to switch to the latest unretracted version, run:
	go get go.opentelemetry.io/otel/exporters/prometheus@latest

[netlify]

✅ Deploy Preview for polite-licorice-3db33c canceled.

Name	Link
🔨 Latest commit	d4d7f47
🔍 Latest deploy log	https://app.netlify.com/projects/polite-licorice-3db33c/deploys/68b1ee83a491000008b0171d

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.