Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the go_modules group across 3 directories with 4 updates

Closed
Number: #21363
Type: Pull Request
State: Closed
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 4
Created: February 25, 2026 at 12:03 AM UTC
(20 days ago)
Updated: February 25, 2026 at 06:06 AM UTC
(20 days ago)
Closed: February 25, 2026 at 06:06 AM UTC
(20 days ago)
Time to Close: about 6 hours
Labels:
documentation dependencies Go
Description:

Bumps the go_modules group with 2 updates in the /go/ql/test/experimental/CWE-321-V2 directory: github.com/go-jose/go-jose/v3 and github.com/golang-jwt/jwt/v5.
Bumps the go_modules group with 1 update in the /go/ql/test/experimental/CWE-525 directory: github.com/gofiber/fiber/v2.
Bumps the go_modules group with 1 update in the /go/ql/test/library-tests/semmle/go/frameworks/Fiber directory: github.com/gofiber/fiber/v2.

Updates github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.4

Release notes

Sourced from github.com/go-jose/go-jose/v3's releases.

v3.0.4

What's Changed

Backport fix for GHSA-c6gw-w398-hv78 CVE-2025-27144 go-jose/go-jose#174

Full Changelog: https://github.com/go-jose/go-jose/compare/v3.0.3...v3.0.4

Version 3.0.3

Fixed

  • Limit decompression output size to prevent a DoS. Backport from v4.0.1.

Version 3.0.2

Fixed

  • DecryptMulti: handle decompression error (#19)

Changed

  • jwe/CompactSerialize: improve performance (#67)
  • Increase the default number of PBKDF2 iterations to 600k (#48)
  • Return the proper algorithm for ECDSA keys (#45)
  • Update golang.org/x/crypto to v0.19 (#94)

Added

  • Add Thumbprint support for opaque signers (#38)

Version 3.0.1

Fixed

Security issue: an attacker specifying a large "p2c" value can cause JSONWebEncryption.Decrypt and JSONWebEncryption.DecryptMulti to consume large amounts of CPU, causing a DoS. Thanks to Matt Schwager (@​mschwager) for the disclosure and to Tom Tervoort for originally publishing the category of attack. https://i.blackhat.com/BH-US-23/Presentations/US-23-Tervoort-Three-New-Attacks-Against-JSON-Web-Tokens.pdf

The release is tagged off the release-v3.0.1 branch to avoid mixing in some as-yet unreleased changes on the v3 branch.

Commits
  • 5253038 Backport fix 167 to v3 (#174)
  • 047dc99 CI: Update github actions and go version (#173)
  • 0f017e9 Revert #26 (ignore unsupported JWKs in Sets) (#131)
  • 3e2bbef Unmarshal jwk keys with unsupported key type or algorithm into empty … (#26)
  • add6a28 v3: backport decompression limit fix (#107)
  • 11bb4e7 doc: in v3 branch's README, point to v4 as latest (#101)
  • 863f73b v3.0.2: Update changelog (#95)
  • bdbc794 Update golang.org/x/crypto to v0.19 (backport) (#94)
  • 25bce79 Updated go-jose v3.0.0 to v3.0.1 in jose-util (#70)
  • aa386df jwe/CompactSerialize: improve performance. (#67)
  • Additional commits viewable in compare view

Updates github.com/golang-jwt/jwt/v5 from 5.0.0 to 5.2.2

Release notes

Sourced from github.com/golang-jwt/jwt/v5's releases.

v5.2.2

What's Changed

New Contributors

Full Changelog: https://github.com/golang-jwt/jwt/compare/v5.2.1...v5.2.2

v5.2.1

What's Changed

New Contributors

Full Changelog: https://github.com/golang-jwt/jwt/compare/v5.2.0...v5.2.1

v5.2.0

What's Changed

New Contributors

Full Changelog: https://github.com/golang-jwt/jwt/compare/v5.1.0...v5.2.0

v5.1.0

What's Changed

... (truncated)

Commits

Updates golang.org/x/crypto from 0.12.0 to 0.19.0

Commits
  • 405cb3b go.mod: update golang.org/x dependencies
  • 913d3ae x509roots/fallback: update bundle
  • dbb6ec1 ssh/test: skip tests on darwin that fail on the darwin-amd64-longtest LUCI bu...
  • 403f699 ssh/test: avoid leaking a net.UnixConn in server.TryDialWithAddr
  • 055043d go.mod: update golang.org/x dependencies
  • 08396bb internal/poly1305: drop Go 1.12 compatibility
  • 9d2ee97 ssh: implement strict KEX protocol changes
  • 4e5a261 ssh: close net.Conn on all NewServerConn errors
  • 152cdb1 x509roots/fallback: update bundle
  • fdfe1f8 ssh: defer channel window adjustment
  • Additional commits viewable in compare view

Updates github.com/gofiber/fiber/v2 from 2.51.0 to 2.52.12

Release notes

Sourced from github.com/gofiber/fiber/v2's releases.

v2.52.12

🐛 Fixes

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.11...v2.52.12

v2.52.11

What's Changed

🧹 Updates

🐛 Bug Fixes

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.10...v2.52.11

v2.52.10

🐛 Bug Fixes

📚 Documentation

New Contributors

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.9...v2.52.10

v2.52.9

🐛 Bug Fixes

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.8...v2.52.9

v2.52.8

👮 Security

  • Fix for BodyParser - GHSA-hg3g-gphw-5hhm

... (truncated)

Commits
  • 6cba195 Bump fiber package version to 2.52.12
  • 5ebbee7 docs: update image paths to v2 in README files
  • 5028167 Merge commit from fork
  • 42380aa fix: adapt tests for v2 - use defer/recover pattern and correct Handler signa...
  • 7cffe29 refactor: use helper function for param route generation in tests
  • 5494de8 🐛 bug: add panic for routes with >30 parameters (GHSA-mrq8-rjmw-wpq3)
  • 65b0f3d Bump version to 2.52.11
  • 1b53334 Modernize error handling in UUID functions (#3941)
  • eb874b6 Merge commit from fork
  • 4ff945a 🩹 bug: Fix ErrorHandler invocation for mounted sub-apps (#3907)
  • Additional commits viewable in compare view

Updates github.com/gofiber/fiber/v2 from 2.48.0 to 2.52.12

Release notes

Sourced from github.com/gofiber/fiber/v2's releases.

v2.52.12

🐛 Fixes

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.11...v2.52.12

v2.52.11

What's Changed

🧹 Updates

🐛 Bug Fixes

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.10...v2.52.11

v2.52.10

🐛 Bug Fixes

📚 Documentation

New Contributors

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.9...v2.52.10

v2.52.9

🐛 Bug Fixes

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.8...v2.52.9

v2.52.8

👮 Security

  • Fix for BodyParser - GHSA-hg3g-gphw-5hhm

... (truncated)

Commits
  • 6cba195 Bump fiber package version to 2.52.12
  • 5ebbee7 docs: update image paths to v2 in README files
  • 5028167 Merge commit from fork
  • 42380aa fix: adapt tests for v2 - use defer/recover pattern and correct Handler signa...
  • 7cffe29 refactor: use helper function for param route generation in tests
  • 5494de8 🐛 bug: add panic for routes with >30 parameters (GHSA-mrq8-rjmw-wpq3)
  • 65b0f3d Bump version to 2.52.11
  • 1b53334 Modernize error handling in UUID functions (#3941)
  • eb874b6 Merge commit from fork
  • 4ff945a 🩹 bug: Fix ErrorHandler invocation for mounted sub-apps (#3907)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.
Package Dependencies
Package:
golang.org/x/crypto
Ecosystem:
go
Version Change:
0.12.0 → 0.19.0
Update Type:
Minor
Package:
github.com/gofiber/fiber/v2
Ecosystem:
go
Version Change:
2.51.0 → 2.52.12
Update Type:
Minor
Package:
github.com/golang-jwt/jwt/v5
Ecosystem:
go
Version Change:
5.0.0 → 5.2.2
Update Type:
Minor
Package:
github.com/go-jose/go-jose/v3
Ecosystem:
go
Version Change:
3.0.0 → 3.0.4
Update Type:
Patch
Security Advisories
Fiber panics when fiber.Ctx.BodyParser parses invalid range index
GHSA-hg3g-gphw-5hhm CVE-2025-48075 HIGH
### Summary When using the `fiber.Ctx.BodyParser` to parse into a struct with range values, a panic occurs when trying to parse a negative range index ### Details `fiber.Ctx.BodyParser` can map fl...
jwt-go allows excessive memory allocation during header parsing
GHSA-mh63-6h87-95cp CVE-2025-30204 HIGH
### Summary Function [`parse.ParseUnverified`](https://github.com/golang-jwt/jwt/blob/c035977d9e11c351f4c05dfeae193923cbab49ee/parser.go#L138-L139) currently splits (via a call to [strings.Split](...
DoS in go-jose Parsing
GHSA-c6gw-w398-hv78 CVE-2025-27144 MODERATE
### Impact When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumptio...
Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
GHSA-mrq8-rjmw-wpq3 CVE-2026-25882 MODERATE
A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability resul...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 14114314
UUID: 3986400249
Node ID: PR_kwDOCIafrM7GEn24
Host: GitHub
Repository: github/codeql