GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: bump go-jose/v4 to v4.1.6 (backport 2.29) by coder[bot] · Pull Request #31454 · coder/coder

Conversation

@coder

@coder coder Bot commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

Backport of the go-jose bump to release/2.29 (same change as #31440 for 2.38; main is already on v4.1.6). Bumps github.com/go-jose/go-jose/v4 from v4.1.4 to v4.1.6, fixing CVE-2026-116587 / GHSA-mgcc-cww5-fp2q (CPU DoS through crafted RSA JWKs). Flagged by the IronBank VAT scan of 2.38.3.

go mod tidy changed no other modules and left the go directive alone. Verified: go test ./coderd/jwtutils/... passes. Local git hooks were skipped; CI is the gate.

Part of ENT-227 (parent ENT-230). Backported to every supported release line per the backport policy in CONTRIBUTING.md.

Opened by Superblink on behalf of @droopy4096.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@coder
fix: bump go-jose/v4 to v4.1.6 (backport 2.29)
d0c7d51 
Fixes CVE-2026-116587 / GHSA-mgcc-cww5-fp2q (CPU DoS via crafted RSA JWKs), flagged by the IronBank VAT scan of 2.38.3.

Refs ENT-227
@linear-code

linear-code Bot commented Oct 28, 2026

Copy link
Copy Markdown

ENT-227
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@github-actions github-actions Bot added the community Pull Requests and issues created by the community. label Oct 28, 2026
@coder coder Bot added cherry-pick/v2.29 Needs to be cherry-picked to the 2.29 release branch and removed community Pull Requests and issues created by the community. labels Oct 28, 2026
@coder coder Bot assigned droopy4096 Oct 28, 2026
@droopy4096
droopy4096 marked this pull request as ready for review October 29, 2026 15:06
@coder
coder Bot requested review from denisra, jdomeracki-coder and zenithwolf1000 October 29, 2026 17:20
denisra
denisra approved these changes Nov 2, 2026
View reviewed changes
@denisra
denisra merged commit 5fd7dc1 into release/2.29 Nov 2, 2026
40 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@denisra
denisra deleted the superblink/ent-227-go-jose-416-release-229 branch November 2, 2026 18:30
@github-actions github-actions Bot locked and limited conversation to collaborators Nov 2, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@denisra denisra denisra approved these changes
@zenithwolf1000 zenithwolf1000 Awaiting requested review from zenithwolf1000
@jdomeracki-coder jdomeracki-coder Awaiting requested review from jdomeracki-coder

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@droopy4096 droopy4096

Labels

cherry-pick/v2.29 Needs to be cherry-picked to the 2.29 release branch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@denisra @droopy4096
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.