Skip to content

Conversation

@taz77
Copy link

@taz77 taz77 commented Oct 2, 2025

A PR to address open security vulnerabilities with ghinstallation inherited from Go JWT package. See linked issue with CVE's

wlynch added a commit to wlynch/ghinstallation that referenced this pull request Oct 10, 2025
This is masking build errors, since go get will auto-modify go.mod.

I noticed this in bradleyfalzon#169 -
the test didn't fail because it re-added jwt/v4 as part of the get,
but golangci-lint failed because it didn't do a similar change.
@wlynch
Copy link
Collaborator

wlynch commented Oct 10, 2025

@taz77 Thanks for the PR!

I think the references to v4 need to be updated in the rest of the source files - e.g.

jwt "github.com/golang-jwt/jwt/v4"

@taz77
Copy link
Author

taz77 commented Oct 11, 2025

@wlynch Opps. Yeah, missed all that. I fixed that along with several other problems. Updated README too

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants