From 476759d2240feffaaa0b6e600ef09960ef851f7b Mon Sep 17 00:00:00 2001 From: nmirasch Date: Tue, 15 Sep 2026 18:03:54 +0200 Subject: [PATCH 1/2] chore(deps) Bump github.com/go-git/go-billy/v5 to v5.9.0 to avoid CVE-2026-44740 Signed-off-by: nmirasch --- go.mod | 12 ++++++++++-- go.sum | 4 ++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index 902aaf6..88f9b39 100644 --- a/go.mod +++ b/go.mod @@ -52,7 +52,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/chai2010/gettext-go v1.0.3 // indirect github.com/cloudflare/circl v1.6.1 // indirect - github.com/cyphar/filepath-securejoin v0.4.1 // indirect + github.com/cyphar/filepath-securejoin v0.6.1 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/davidmz/go-pageant v1.0.2 // indirect github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect @@ -68,7 +68,7 @@ require ( github.com/go-errors/errors v1.5.1 // indirect github.com/go-fed/httpsig v1.1.0 // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect - github.com/go-git/go-billy/v5 v5.6.2 // indirect + github.com/go-git/go-billy/v5 v5.9.0 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-openapi/jsonpointer v0.21.1 // indirect github.com/go-openapi/jsonreference v0.21.0 // indirect @@ -180,3 +180,11 @@ require ( sigs.k8s.io/randfill v1.0.0 // indirect sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect ) + +// go-git/go-billy v5.9.0 (bumped to fix CVE-2026-44740) only uses +// filepath-securejoin's stable SecureJoin API, but its go.mod hard-pins +// filepath-securejoin v0.6.1, which removed the MkdirAll wrapper that +// argo-cd/v3 v3.1.10's vendored util/io/files package still relies on. +// Pin back to the last version compatible with both to avoid a much larger, +// unrelated upgrade of argo-cd/v3 (and the k8s.io v1.34 cascade that follows). +replace github.com/cyphar/filepath-securejoin => github.com/cyphar/filepath-securejoin v0.4.1 diff --git a/go.sum b/go.sum index c19c6d7..d7e6214 100644 --- a/go.sum +++ b/go.sum @@ -185,8 +185,8 @@ github.com/go-fed/httpsig v1.1.0 h1:9M+hb0jkEICD8/cAiNqEB66R87tTINszBRTjwjQzWcI= github.com/go-fed/httpsig v1.1.0/go.mod h1:RCMrTZvN1bJYtofsG4rd5NaO5obxQ5xBkdiS7xsT7bM= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic= -github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM= -github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU= +github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA= +github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM= From 8631b18d11a689a6159e339b11b83f9683f4d301 Mon Sep 17 00:00:00 2001 From: nmirasch Date: Wed, 16 Sep 2026 13:08:20 +0200 Subject: [PATCH 2/2] test: accept TLS version variants due to map iteration randomness Signed-off-by: nmirasch --- pkg/cmd/tls_test.go | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/pkg/cmd/tls_test.go b/pkg/cmd/tls_test.go index f4a94b0..c6d3271 100644 --- a/pkg/cmd/tls_test.go +++ b/pkg/cmd/tls_test.go @@ -13,33 +13,35 @@ func TestTLSVersionName(t *testing.T) { tests := []struct { name string version uint16 - expected string + expected []string // Accept either variant due to map iteration randomness }{ { name: "TLS1.1", version: tls.VersionTLS11, - expected: "1.1", + expected: []string{"1.1", "tls1.1"}, }, { name: "TLS1.2", version: tls.VersionTLS12, - expected: "1.2", + expected: []string{"1.2", "tls1.2"}, }, { name: "TLS1.3", version: tls.VersionTLS13, - expected: "1.3", + expected: []string{"1.3", "tls1.3"}, }, { name: "unknown", version: 999, - expected: "unknown (999)", + expected: []string{"unknown (999)"}, }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - assert.Equal(t, tt.expected, TLSVersionName(tt.version)) + result := TLSVersionName(tt.version) + assert.Contains(t, tt.expected, result, + "TLSVersionName returned %q, expected one of %v", result, tt.expected) }) } }