GeezerVison

❌ Go dependencies check failed

There are outdated Go dependencies, or modules that could not be inspected.
Run bash .github/scripts/go-deps.sh --update --discover locally and
commit the updated go.mod / go.sum files.

🔍 Discovered 25 Go projects

📦 Dependencies with updates available:

  📁 ./plugins/gcp:
     - google.golang.org/api: v0.299.0 → v0.304.0

  📁 ./plugins/aws:
     - github.com/aws/aws-sdk-go-v2: v1.47.0 → v1.47.3
     - github.com/aws/aws-sdk-go-v2/config: v1.33.5 → v1.33.9
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.5 → v1.20.9
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.88.0 → v1.89.3

  📁 ./plugins/alerts:
     - github.com/tidwall/gjson: v1.19.0 → v1.20.0

  📁 ./plugins/events:
     - github.com/tidwall/gjson: v1.19.0 → v1.20.0

  📁 ./plugins/modules-config:
     - github.com/Azure/azure-sdk-for-go/sdk/storage/azblob: v1.8.1 → v1.8.2
     - github.com/aws/aws-sdk-go-v2/config: v1.33.5 → v1.33.9
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.5 → v1.20.9
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.88.0 → v1.89.3
     - github.com/aws/aws-sdk-go-v2/service/sts: v1.51.0 → v1.51.4
     - github.com/crowdstrike/gofalcon: v0.22.0 → v0.23.0
     - golang.org/x/sync: v0.23.0 → v0.24.0
     - google.golang.org/api: v0.299.0 → v0.304.0

  📁 ./plugins/azure:
     - github.com/Azure/azure-sdk-for-go/sdk/azcore: v1.23.1 → v1.23.3
     - github.com/Azure/azure-sdk-for-go/sdk/storage/azblob: v1.8.1 → v1.8.2

  📁 ./plugins/crowdstrike:
     - github.com/crowdstrike/gofalcon: v0.22.0 → v0.23.0

  📁 ./plugins/geolocation:
     - github.com/tidwall/gjson: v1.19.0 → v1.20.0

  📁 ./installer:
     - github.com/cloudfoundry/gosigar: v1.3.127 → v1.3.128

  📁 ./agent:
     - github.com/netsampler/goflow2: v1.3.7 → v1.3.8
     - golang.org/x/sys: v0.48.0 → v0.49.0

�[0;31m❌ Please update dependencies before merging.�[0m

🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

🛑 architecture (silas-1.7-pro) — blocking — must fix before merge

Summary: Tier 3 due to new TFA/auth endpoints and password flow; remove hardcoded backend DB IDs and reuse shared auth/config contracts.

• high frontend/src/app/federation/services/federation-tfa-service.ts:8 — New TFA auth endpoints are hard-coded in a frontend service. Treat this as an auth contract change: reuse the existing shared auth/API layer and document endpoint compatibility, session/2FA requirements, and rollout constraints.
• medium frontend/src/app/federation/pages/tfa-config/federation-tfa-config-section.const.ts:9 — Frontend mirrors backend DB rows with sectionId 3 and parameter IDs 17/10000. Do not expose persisted schema identifiers in frontend code; fetch configuration through the API or use a contract that does not depend on DB row IDs.
• medium frontend/src/app/federation/pages/tfa-config/federation-tfa-config.page.component.ts:47 — The page builds partial SectionConfigParamType objects and casts them via unknown, duplicating TFA config definitions and relying on UtmTfaConfCheck internals. Use full shared config objects or define a typed input contract for the TFA check component.
• medium frontend/src/app/federation/services/federation-tfa-service.ts:14 — me() duplicates existing current-user retrieval. Reuse the shared auth service/user model instead of adding another wrapper around /api/v1/auth/me.
• medium frontend/src/app/federation/components/tfa-disable-modal/tfa-disable-modal.component.ts:24 — The raw password is returned through the modal close result and then sent by the page. Avoid passing secrets via modal callbacks; perform the disable action from the modal or use a short-lived confirmation token.

🛑 bugs (silas-1.7-pro) — blocking — must fix before merge

Summary: New TFA config page is mostly wired, but admin-only route blocks regular users and error/state handling for /auth/me and disable failures is incomplete.

• high frontend/src/app/app-routing.module.ts:182 — The tfa-config route is restricted to ADMIN_ROLE, but the page operates on the current user's own two-factor authentication and is linked unconditionally from the federation user menu. A non-admin user clicking the new 2FA Configuration menu item will be blocked from configuring or disabling their own TFA. Use an authenticated-user authority or hide the menu item for non-admins.
• medium frontend/src/app/federation/pages/tfa-config/federation-tfa-config.page.component.ts:42 — loadUser() subscribes to tfaService.me() with no error callback. If /auth/me fails, the page silently remains uninitialized with no user-facing error. Add an error handler or catchError and show a toast or fallback state.
• medium frontend/src/app/federation/pages/tfa-config/federation-tfa-config.page.component.ts:42 — loadUser() overwrites this.sub without unsubscribing the previous me() subscription. If loadUser() is called while an earlier request is still in flight, the older subscription can remain active or update component state after a newer request. Track all subscriptions and unsubscribe them before reassigning or in ngOnDestroy().
• medium frontend/src/app/federation/pages/tfa-config/federation-tfa-config.page.component.ts:89 — disableTfa() and complete() start HTTP subscriptions that are not stored or unsubscribed in ngOnDestroy(). If the user navigates away while the request is pending, the callbacks can still run after the component is destroyed, updating state and triggering loadUser()/toast side effects. Use takeUntil(destroy$) or keep and unsubscribe these subscriptions.
• medium frontend/src/app/federation/pages/tfa-config/federation-tfa-config.page.component.ts:95 — The disableTfa() error path shows a toast but does not restore the toggle to the enabled state. If the password is rejected, the switch can remain visually off even though tfaEnabled is still true on the server. Call rejectSwitch() or set switchActive and toggle.active back to true on error.
• low frontend/src/app/federation/pages/tfa-config/federation-tfa-config.page.component.html:6 — The displayed method is hard-coded to TOTP (Authenticator App) regardless of user.tfaMethod. A user whose method is EMAIL will see the wrong method. Render the actual method from this.user.tfaMethod.

🛑 security (silas-1.7-pro) — blocking — must fix before merge

Summary: No introduced vulnerabilities identified; TFA authentication changes are marked Tier 3 for human verification.

No findings.