Skip to content

Update go-jose to v4.1.6 - #404

Merged
funkyshu merged 1 commit into
mainfrom
fix/go-jose-v4.1.6
Nov 5, 2026
Merged

funkyshu merged 1 commit into
mainfrom
fix/go-jose-v4.1.6

Conversation

@funkyshu

@funkyshu funkyshu commented Nov 5, 2026

Copy link
Copy Markdown
Member

Summary

Updates the indirect dependency github.com/go-jose/go-jose/v4 from v4.1.4 to v4.1.6 in the core module, resolving the open Dependabot advisories:

testcontainers builds against the local core module, so its go.mod and go.sum are tidied to match, which resolves its alerts too. The contrib/vfsevents module is separate and is tracked by #403.

The go directive is unchanged in both modules.

Closes #401
Closes #402

Testing

  • go test -race ./... and golangci-lint pass in the core module.
  • go build and go vet -tags=vfsintegration pass in testcontainers.

Resolves the go-jose advisories GHSA-vvm8-gf78-28g4, GHSA-4w3g-jfj2-cw2q and
GHSA-mgcc-cww5-fp2q in the core module. The testcontainers module builds
against the local core module, so its go.mod and go.sum are tidied to match.
@c2fo-cibot c2fo-cibot Bot added the size/S Denotes a PR that changes 10-29 lines label Nov 5, 2026
@funkyshu
funkyshu merged commit f8ebb5e into main Nov 5, 2026
25 checks passed
@funkyshu
funkyshu deleted the fix/go-jose-v4.1.6 branch November 5, 2026 19:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/S Denotes a PR that changes 10-29 lines

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security: update go-jose to v4.1.6 in testcontainers (Dependabot #51-#53) Security: update go-jose to v4.1.6 in the core module (Dependabot #48-#50)

1 participant