Skip to content

CSPL-4153: Update dependencies to fix security vulnerabilities#1809

Open
gabrielm-splunk wants to merge 1 commit intodevelopfrom
cspl-4153-update-dependencies
Open

CSPL-4153: Update dependencies to fix security vulnerabilities#1809
gabrielm-splunk wants to merge 1 commit intodevelopfrom
cspl-4153-update-dependencies

Conversation

@gabrielm-splunk
Copy link
Copy Markdown
Collaborator

Summary

Updates dependencies to address security vulnerabilities identified in VULN tickets.

Changes

  • google.golang.org/grpc: v1.78.0 → v1.79.3 (Fixes VULN-67797 - CVE-2026-33186)
  • github.com/buger/jsonparser: v1.1.1 → v1.1.2 (Fixes VULN-67794)
  • Go stdlib: 1.25.7 → 1.25.8 (Fixes VULN-65734)
  • gnutls: Updated via explicit microdnf update in Dockerfile (Fixes VULN-69140)
  • Other dependencies updated to latest compatible versions via go get -u

Testing

  • Unit tests passing (running)
  • GitLab smoke tests pending
  • GitLab integration tests pending
  • Container scan pending

Next Steps

  • Wait for unit tests to complete
  • Trigger GitLab CI/CD with container scan enabled
  • Verify all VULN tickets are resolved in container scan results

Related Issues

  • Fixes: CSPL-4153
  • Resolves: VULN-67797, VULN-67794, VULN-65734, VULN-69140

🤖 Generated with Claude Code

- Update google.golang.org/grpc from v1.78.0 to v1.79.3 (VULN-67797)
- Update github.com/buger/jsonparser from v1.1.1 to v1.1.2 (VULN-67794)
- Update Go stdlib from 1.25.7 to 1.25.8 (VULN-65734)
- Update gnutls via explicit microdnf update (VULN-69140)
- Update other dependencies to latest compatible versions

Fixes: VULN-67797, VULN-67794, VULN-65734, VULN-69140

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@gabrielm-splunk
Copy link
Copy Markdown
Collaborator Author

Unit Tests Passed

All unit tests completed successfully:

  • Test Suite: PASSED
  • Coverage: 97.3% of statements
  • Composite Coverage: 83.5% of statements

🔍 Container Scan Pipeline Triggered

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant