Repository navigation
Bump dependencies flagged by GitHub repository advisories - #7320
Merged
Merged
Conversation
Maintainers publish GitHub repository security advisories before they reach the Go vulnerability database, so govulncheck misses them. Add tools/repoadvisory, which checks the modules linked into the CLI against those advisories and emits the ones with a patched version as govulncheck-format JSON, and feed its output into vulnbump alongside govulncheck. Advisories without a patched version are logged and skipped. vulnbump now links each advisory to the URL in its osv record when set, so GHSA IDs link to their GitHub page. The workflow gains a dry_run dispatch input that skips the pull request and failure issue. Co-authored-by: Isaac <no-reply@databricks.com>
Collaborator
Integration test reportCommit: fa56919
Top 5 slowest tests (at least 2 minutes):
|
pietern
marked this pull request as ready for review
November 3, 2026 15:19
pietern
enabled auto-merge
November 3, 2026 15:24
andrewnester
approved these changes
Nov 3, 2026
| @@ -0,0 +1 @@ | |||
| /repoadvisory | |||
Contributor
Author
There was a problem hiding this comment.
This likely matches an existing pattern in sibling tool directories.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The vulnerable-dependency bumper only sees advisories in the Go vulnerability database. Maintainers often publish a GitHub repository security advisory (GHSA) days or weeks before it reaches GitHub's global advisory database and, from there, the Go vulnerability database. Until then neither govulncheck nor Dependabot reports it.
go.opentelemetry.io/otel/tracev1.44.0 is an example: GHSA-q7gw-24fr-5p69 was published on Oct 28 with a fix in v1.47.0, and none of these databases has it yet.This is a first step toward GHSA support. A new tool,
tools/repoadvisory, maps each module linked into the CLI to its GitHub repository and checks it against that repository's published advisories. It emits only the advisories that name a patched version, as govulncheck-format JSON. Those without a patched version are logged and skipped, since there is nothing to bump to. The workflow feeds this output intovulnbumpalongside govulncheck's, and the existing all-or-nothing behavior is unchanged: if any bump fails, no PR is opened and the run fails.vulnbumpnow links each advisory to the URL in its record, so GHSA IDs link to their GitHub page. Adry_rundispatch input computes and shows the bump without creating a pull request or failure issue.Against current main this produces one bump, otel 1.44.0 → 1.47.0. The two pgx advisories (GHSA-j38q-h3ph-jjpq, GHSA-95fj-3fxw-g62g) name no patched version and are skipped.
This pull request and its description were written by Isaac.