From 991c7413587a8fe2b61ab4400a322f3681cf4e23 Mon Sep 17 00:00:00 2001 From: Konrad Ferdinand Heimel Date: Fri, 31 Jul 2026 15:54:39 +0200 Subject: [PATCH 1/3] :lock: fix(deps): bump goldmark 1.7.17 and otel 1.44.0 for GO-2026-5320/5158 Clears the two Scorecard/govulncheck module-graph findings (both unreachable transitive deps, not in any called path): - GO-2026-5320 XSS in github.com/yuin/goldmark v1.4.13 -> v1.7.17 - GO-2026-5158 baggage parsing in go.opentelemetry.io/otel v1.43.0 -> v1.44.0 govulncheck now reports 0 vulnerabilities. No generated CRD drift from the goldmark parser bump (make generate is a no-op). --- go.mod | 6 +++--- go.sum | 15 ++++++++------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/go.mod b/go.mod index b4dd518..1daed90 100644 --- a/go.mod +++ b/go.mod @@ -110,11 +110,11 @@ require ( github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect github.com/x448/float16 v0.8.4 // indirect github.com/xhit/go-str2duration/v2 v2.1.0 // indirect - github.com/yuin/goldmark v1.4.13 // indirect + github.com/yuin/goldmark v1.7.17 // indirect github.com/zclconf/go-cty v1.16.2 // indirect github.com/zclconf/go-cty-yaml v1.0.3 // indirect - go.opentelemetry.io/otel v1.43.0 // indirect - go.opentelemetry.io/otel/trace v1.43.0 // indirect + go.opentelemetry.io/otel v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.27.1 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect diff --git a/go.sum b/go.sum index 1a29241..98c804a 100644 --- a/go.sum +++ b/go.sum @@ -298,8 +298,9 @@ github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8 github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= -github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= +github.com/yuin/goldmark v1.7.17 h1:p36OVWwRb246iHxA/U4p8OPEpOTESm4n+g+8t0EE5uA= +github.com/yuin/goldmark v1.7.17/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg= github.com/zclconf/go-cty v1.2.0/go.mod h1:hOPWgoHbaTUnI5k4D2ld+GRpFJSCe6bCM7m1q/N4PQ8= github.com/zclconf/go-cty v1.8.0/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk= github.com/zclconf/go-cty v1.8.1/go.mod h1:vVKLxnk3puL4qRAv72AO+W99LUD4da90g3uUAzyuvAk= @@ -314,20 +315,20 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 h1:ssfIgGNANqpVFCndZvcuyKbl0g+UAVcbBcqGkG28H0Y= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0/go.mod h1:GQ/474YrbE4Jx8gZ4q5I4hrhUzM6UPzyrqJYV2AqPoQ= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 h1:in9O8ESIOlwJAEGTkkf34DesGRAc/Pn8qJ7k3r/42LM= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0/go.mod h1:Rp0EXBm5tfnv0WL+ARyO/PHBEaEAT8UUHQ6AGJcSq6c= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4= go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= From 792a62748e4170b772da0e402cfe3bd355fb45b2 Mon Sep 17 00:00:00 2001 From: Konrad Ferdinand Heimel Date: Fri, 31 Jul 2026 15:54:39 +0200 Subject: [PATCH 2/3] :lock: fix(ci): add workflow-level read-only permission floor to e2e.yaml Clears Scorecard 'no topLevel permission defined' on e2e.yaml. All three jobs already declare their own permissions, so the top-level contents: read floor strips nothing; it brings e2e.yaml in line with the other workflows. --- .github/workflows/e2e.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 76bc20a..dc80fee 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -8,9 +8,12 @@ on: issue_comment: types: [created] -# Job-scoped permissions (REQ-SONAR-PG-04): no workflow-level contents: read. -# Jobs that checkout / call the GitHub API declare permissions locally; jobs that -# POST commit statuses also elevate statuses: write. +# Least-privilege token (REQ-SONAR-PG-04): a workflow-level read-only floor, +# with each job elevating only what it needs. Jobs that checkout / call the +# GitHub API keep contents: read; jobs that POST commit statuses add statuses: write. +permissions: + contents: read + env: GO_VERSION: "1.26.5" From a8cbc3ce9e49bfe4a343b1a050da244750b89df1 Mon Sep 17 00:00:00 2001 From: Konrad Ferdinand Heimel Date: Fri, 31 Jul 2026 15:56:07 +0200 Subject: [PATCH 3/3] docs(changelog): regenerate for harden-vuln-perms-030 branch --- CHANGELOG.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4474bdc..66f7960 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,9 +10,16 @@ Release notes are generated from [Conventional Commits](https://www.conventional ## [Unreleased] +### Bug Fixes + +- **ci:** Add workflow-level read-only permission floor to e2e.yaml [792a627](https://github.com/platformrelay/provider-gridscale/commit/792a62748e4170b772da0e402cfe3bd355fb45b2) + +- **deps:** Bump goldmark 1.7.17 and otel 1.44.0 for GO-2026-5320/5158 [991c741](https://github.com/platformrelay/provider-gridscale/commit/991c7413587a8fe2b61ab4400a322f3681cf4e23) + + ### Documentation -- **readme:** Drop the broken ghcr.io Container badge link [50281a6](https://github.com/platformrelay/provider-gridscale/commit/50281a64098533ad791f918e7d5767bb83fd534f) +- **readme:** Drop the broken ghcr.io Container badge link [a18fd3c](https://github.com/platformrelay/provider-gridscale/commit/a18fd3c5d875c2ed6a0cf188418bb6ea8563eb7f) ## [0.3.0](https://github.com/platformrelay/provider-gridscale/compare/v0.2.2..v0.3.0) - 2026-07-29