Repository navigation
security(deps): 🛡️ Go 1.26.8, gRPC 1.83.2, x/net 0.59.0, aws-sdk-go-v2 s3 1.113.4 - #203
Conversation
…2 s3 1.113.4
Clears all 52 Snyk findings (2 CRITICAL, 26 HIGH, 22 MEDIUM, 2 LOW);
govulncheck: 0 reachable (was 42). Tracked by AB#766146 (grpc),
AB#766148 (x/net), AB#766149 (aws-sdk-go-v2), AB#766150 (toolchain).
- go.mod: toolchain go1.24.1 -> go1.26.8; go directive 1.23.0 -> 1.26.0
(current golang.org/x/* modules require it). aqua.yaml golang/go and
the ADO PR pipeline's GoTool pin move to 1.26.8 to match.
- grpc 1.64.1 -> 1.83.2, x/net 0.38.0 -> 0.59.0, x/text, x/crypto,
aws-sdk-go-v2 service/s3 1.55.1 -> 1.113.4 (eventstream 1.7.20).
- vendor/ regenerated. .gitignore 'tools' anchored to '/tools': the
unanchored rule silently dropped the newly vendored golang.org/x/tools.
- go >= 1.24 vet rejects fmt.Errorf with a non-constant format string:
three test stubs now use fmt.Errorf("%s", ...).
- Trunk: trivy 0.53.0 (deleted upstream) -> 0.74.0, go@1.26.8,
golangci-lint 1.64.8, node@22.16.0; drop golangci 'output: tab',
which breaks Trunk's parser.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #203 +/- ##
===========================================
+ Coverage 32.61% 48.28% +15.67%
===========================================
Files 80 87 +7
Lines 10855 11914 +1059
===========================================
+ Hits 3540 5753 +2213
+ Misses 7027 5866 -1161
- Partials 288 295 +7 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Why
|
| request | dev (*.devbambe.com) |
QA (*.qabambe.com) |
|---|---|---|
GET /v1/secrets/x |
401 {"message":"Unauthorized"} (app) |
n/a |
POST /v1/crypto/manual/key/x |
403, empty body |
401 {"message":"Unauthorized"} (app) |
POST /v1/crypto/auto/key/x |
403, empty body |
n/a |
POST /v1/crypto/manual/encrypt |
403, empty body |
n/a |
No app-api span exists for the failing requests (checked in Datadog dsvdevqa), so the 403 comes from API Gateway or the edge, not from DSV code. QA's same route reaches the app.
The server code hasn't changed. api-bambe domains/encryption/ was last modified 2023-10, and there are no crypto, permission or licence commits since 2026-02.
History: the last integration run whose tests actually executed passed on 2026-02-10 (PR build(gomod): ⚡ patch gomod #190). The 09-17 runs (Renovate build(aqua-proj): 🌊 major aqua major (major) #191) died at mage build:single, before any tests ran.
Most likely cause: the dev environment's partly failed September API deploy (Thycotic.Vault-API Release-1943 failed at dev-us-east-1) left the encryption-as-a-service routes or their Lambda broken on dev. This is being tracked separately as part of the release-pipeline repair.
Everything else passes: all GitHub checks (lint, test, both Snyk checks, codecov, Trunk), dsv-cli.tests.end-to-end, and the live end-to-end run described in the PR body.
Merge plan: once a dsv-contributors review is in, merge with admin bypass for (1) this required integration check, which fails on the dev outage above, and (2) the dsv-admins code-owner requirement. The only admin-owned path in the diff is the vendored third-party file vendor/go.opentelemetry.io/otel/CODEOWNERS, which matches because the root CODEOWNERS patterns are unanchored. A follow-up will anchor them to /CODEOWNERS and /.github.
🤖 Generated with Claude Code
…ly disabled (#204) The required **`dsv-cli.tests.integration`** check has failed on every PR since Feb 2026 because of the crypto cases. That's why recent PRs (e.g. #203) needed admin bypass. ## Why The DSV crypto API (EaaS, `/v1/crypto/*`) is **intentionally disabled server-side**. An API Gateway **MOCK integration returns 403** on `/v1/crypto/{proxy+}` on dev (2026-02-06/12) and in **all four prod regions** (2026-02-20). **Tom Dillenbeck confirmed** (2026-09-29) he added it after a security finding; the feature had no customer usage. Every `crypto-manual-*` case gets a 403 from the edge and fails. ## Change - `cicd-integration/integration_test.go`: cases named `crypto-*` call `t.Skip(...)` with the reason, so they show as **SKIP** in the output instead of vanishing. That's the 6 cases: 5 `EaaS-Manual` + `crypto-manual-key-delete` in cleanup. No other case depends on them. Re-enabling is deleting the guard. - changie entry. The CLI's `crypto` commands are unchanged; only the integration test stops expecting the server to answer. Companion change for the backend acceptance tests: api-bambe PR 228980 (ADO). ## Testing `go vet ./cicd-integration/` and `gofmt`: clean. The real verification is this PR's `dsv-cli.tests.integration` run against the dev tenant: expect the `crypto-*` subtests as SKIP and everything else as PASS. 🤖 Generated with [Claude Code](https://claude.com/claude-code) [AB#767047](https://thycotic.visualstudio.com/4a89362e-1361-424f-a291-a8f57c2a8991/_workitems/edit/767047) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Clears all 52 Snyk findings in
dsv-cli, including 2 CRITICAL.govulncheckgoes from 42 reachable vulnerabilities → 0.dsv-cliisn't onboarded to the ArmorCode runbook, so these were ticketed manually:AB#766146 (grpc, CRITICAL) · AB#766148 (x/net, CRITICAL) · AB#766149 (aws-sdk-go-v2, HIGH) · AB#766150 (Go toolchain / stdlib, HIGH)
Scans (local)
mainChanges
toolchain go1.24.1 → go1.26.8. Thegodirective goes 1.23.0 → 1.26.0 because currentgolang.org/x/*modules declare it;dsv-cliis a binary, so only builders are affected.aqua.yamlgolang/go(which the ADO pipelines read their Go version from) and the threeGoTool@0pins inpipelines/vault-cli-pr.ymlmove to 1.26.8 to match.google.golang.org/grpc1.64.1 → 1.83.2golang.org/x/net0.38.0 → 0.59.0;x/text,x/cryptorefreshedaws-sdk-go-v2/service/s31.55.1 → 1.113.4 (aws/protocol/eventstream→ 1.7.20)vendor/regenerated..gitignore's unanchoredtoolsrule silently excluded the newly vendoredgolang.org/x/tools/, which builds locally and fails in CI. Anchored to/tools, so it still ignores only the roottools/directory. A fresh clone builds and tests with-mod=vendor.vet(run bygo test) rejectsfmt.Errorfwith a non-constant format string, andmainnever hit this because it declared go 1.23. Three test stubs now usefmt.Errorf("%s", …)with a scoped//nolint:err113.trivy0.53.0 (release deleted upstream, so the hermetic install 404s) → 0.74.0;go@1.26.8;golangci-lint1.64.8 (last v1, keeps.golangci.yamlv1);node@22.16.0. Removed golangcioutput.formats: tab, which breaks Trunk's parser.Testing
go test ./...: 15/15 packages pass; pre-push hook: 675 tests, 1 skipped (GCP creds).go build -mod=vendor .andgo test -mod=vendor ./...pass.trunk check --upstream origin/main: no new issues.auth,config readandwhoami. Result: 20/21, identical to the released v1.41.1 run through the same script. The one miss (secret read --version 0 -f data.k: "Failed to apply the filter") fails the same way on v1.41.1, so it's a pre-existing quirk, not a regression. All test objects deleted (404 verified).Not in this PR
pipelines/vault-cli.yml: goreleaser → GitHub, S3, brew, scoop, snap, docker; plus signing). The last release was v1.41.1 (2024-05). There are 8 unreleased changie entries, including a feature, so the next is v1.42.0. That's a follow-up with its own pre-flight.go vet ./...still reportsvaultcliunkeyed struct fields, andgo build ./...reports "main is undeclared" formagefilesandcicd-integration(bothpackage mainwithout a regular main). Both are identical onmain.🤖 Generated with Claude Code