Repository navigation
fix(deps): go-jose 4.1.6 (GHSA-mgcc-cww5-fp2q) and v0.1.30 - #201
Conversation
…a JWK GHSA-mgcc-cww5-fp2q (CVE-2026-116587): parsing a JWK with a very large RSA key could exhaust the CPU. The gateway includes go-jose through go-oidc (the ID token check), the CLI through go-spiffe (Sigstore verification).
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Release version and dependency updates web/package.json, convox.yml, go.mod |
The web package version and gateway and admin image tags changed to 0.1.30. The indirect github.com/go-jose/go-jose/v4 dependency changed from v4.1.5 to v4.1.6. |
Priority:
Estimated code review effort: 1 (Trivial) | ~4 minutes
Change: Other
Possibly related PRs
- DocSpring/rack-gateway#198: Both PRs update the go-jose dependency path used by CLI release verification.
Merge Risk: 
80a70
-
The release metadata, image tags, and go-jose dependency update are consistent; the change is mergeable.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly identifies the go-jose dependency upgrade and the v0.1.30 release update, which match the main changes. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the tags in rows,
The gateway gets a newer coat.
The admin image follows too,
The web version steps up new.
A small dependency joins the ride,
Then hops away with ears held wide.
Comment @coderabbitai help to get the list of available commands.
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Oct 30, 2026 4:38a.m. | Review ↗ |
| Go | |
Oct 30, 2026 4:38a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
Upgrades
github.com/go-jose/go-jose/v4from 4.1.5 to 4.1.6 for GHSA-mgcc-cww5-fp2q (CVE-2026-116587): parsing a JWK with a very large RSA key could exhaust the CPU. 4.1.6 caps the RSA modulus it accepts at 4096 bits.The nightly Security Scan's Trivy check of the published image reports it as HIGH, so the release image needs the fix.
rack-gateway update, which reads trusted roots and attestation bundles.Also bumps the version to v0.1.30 so the fix can be released. Supersedes #200 (the same go.mod change from Dependabot).
Summary by CodeRabbit