PMM-14577 CVEs fix. by JiriCtvrtka · Pull Request #7 · Percona-Lab/spec

JiriCtvrtka · 2025-12-22T09:12:21Z

PMM-14577

Bumps the development-dependencies group with 1 update: [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata). Updates `dependabot/fetch-metadata` from 1 to 2 - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](dependabot/fetch-metadata@v1...v2) --- updated-dependencies: - dependency-name: dependabot/fetch-metadata dependency-type: direct:production update-type: version-update:semver-major dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the development-dependencies group with 1 update: [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action). Updates `golangci/golangci-lint-action` from 4 to 5 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@v4...v5) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the development-dependencies group with 1 update: [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action). Updates `golangci/golangci-lint-action` from 5 to 6 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@v5...v6) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the development-dependencies group with 1 update: [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `codecov/codecov-action` from 4 to 5 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v4...v5) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-major dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.9.0 to 1.10.0. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.9.0...v1.10.0) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

…es/github.com/stretchr/testify-1.10.0 Bump github.com/stretchr/testify from 1.9.0 to 1.10.0

* updated linter config * fixed linting errors Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

Bumps the go-openapi-dependencies group with 2 updates: [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer) and [github.com/go-openapi/swag](https://github.com/go-openapi/swag). Updates `github.com/go-openapi/jsonpointer` from 0.21.0 to 0.21.1 - [Commits](go-openapi/jsonpointer@v0.21.0...v0.21.1) Updates `github.com/go-openapi/swag` from 0.23.0 to 0.23.1 - [Commits](go-openapi/swag@v0.23.0...v0.23.1) --- updated-dependencies: - dependency-name: github.com/go-openapi/jsonpointer dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-openapi-dependencies - dependency-name: github.com/go-openapi/swag dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-openapi-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

Fixed broken test coverage upload to codecov with codecov-action@v5. * fixed tokenless upload (now supported with codecov v5) * fixed flags for codecov * fixed coverage for windows (now use bash instead of powershell) Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

Bumps the development-dependencies group with 1 update: [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action). Updates `golangci/golangci-lint-action` from 7 to 8 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@v7...v8) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>

Bumps the go-openapi-dependencies group with 1 update: [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer). Updates `github.com/go-openapi/jsonpointer` from 0.21.1 to 0.21.2 - [Commits](go-openapi/jsonpointer@v0.21.1...v0.21.2) --- updated-dependencies: - dependency-name: github.com/go-openapi/jsonpointer dependency-version: 0.21.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-openapi-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the development-dependencies group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 4 to 5 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the development-dependencies group with 1 update: [github.com/stretchr/testify](https://github.com/stretchr/testify). Updates `github.com/stretchr/testify` from 1.10.0 to 1.11.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.10.0...v1.11.1) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

go-openapi has introduced a new API to better insulate dependencies. We move to the new modules, even though at this stage this doesn't change our indirect dependencies. Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

Bumps the development-dependencies group with 1 update: [actions/setup-go](https://github.com/actions/setup-go). Updates `actions/setup-go` from 5 to 6 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v5...v6) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the go-openapi-dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [github.com/go-openapi/swag/conv](https://github.com/go-openapi/swag) | `0.24.0` | `0.25.0` | | [github.com/go-openapi/swag/jsonname](https://github.com/go-openapi/swag) | `0.24.0` | `0.25.0` | | [github.com/go-openapi/swag/jsonutils](https://github.com/go-openapi/swag) | `0.24.0` | `0.25.0` | | [github.com/go-openapi/swag/loading](https://github.com/go-openapi/swag) | `0.24.0` | `0.25.0` | | [github.com/go-openapi/swag/stringutils](https://github.com/go-openapi/swag) | `0.24.0` | `0.25.0` | Updates `github.com/go-openapi/swag/conv` from 0.24.0 to 0.25.0 - [Commits](go-openapi/swag@v0.24.0...v0.25.0) Updates `github.com/go-openapi/swag/jsonname` from 0.24.0 to 0.25.0 - [Commits](go-openapi/swag@v0.24.0...v0.25.0) Updates `github.com/go-openapi/swag/jsonutils` from 0.24.0 to 0.25.0 - [Commits](go-openapi/swag@v0.24.0...v0.25.0) Updates `github.com/go-openapi/swag/loading` from 0.24.0 to 0.25.0 - [Commits](go-openapi/swag@v0.24.0...v0.25.0) Updates `github.com/go-openapi/swag/stringutils` from 0.24.0 to 0.25.0 - [Commits](go-openapi/swag@v0.24.0...v0.25.0) --- updated-dependencies: - dependency-name: github.com/go-openapi/swag/conv dependency-version: 0.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-openapi-dependencies - dependency-name: github.com/go-openapi/swag/jsonname dependency-version: 0.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-openapi-dependencies - dependency-name: github.com/go-openapi/swag/jsonutils dependency-version: 0.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-openapi-dependencies - dependency-name: github.com/go-openapi/swag/loading dependency-version: 0.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-openapi-dependencies - dependency-name: github.com/go-openapi/swag/stringutils dependency-version: 0.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-openapi-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

…alse positives Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

Signed-off-by: Oleksandr Redko <oleksandr.red+github@gmail.com>

Bumps the development-dependencies group with 1 update: [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action). Updates `golangci/golangci-lint-action` from 8 to 9 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@v8...v9) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>

Bumps the development-dependencies group with 7 updates: | Package | From | To | | --- | --- | --- | | [go-openapi/ci-workflows/.github/workflows/auto-merge.yml](https://github.com/go-openapi/ci-workflows) | `0.1.1` | `0.1.2` | | [go-openapi/ci-workflows/.github/workflows/bump-release.yml](https://github.com/go-openapi/ci-workflows) | `0.1.1` | `0.1.2` | | [go-openapi/ci-workflows/.github/workflows/codeql.yml](https://github.com/go-openapi/ci-workflows) | `0.1.1` | `0.1.2` | | [go-openapi/ci-workflows/.github/workflows/contributors.yml](https://github.com/go-openapi/ci-workflows) | `0.1.1` | `0.1.2` | | [go-openapi/ci-workflows/.github/workflows/go-test.yml](https://github.com/go-openapi/ci-workflows) | `0.1.1` | `0.1.2` | | [go-openapi/ci-workflows/.github/workflows/scanner.yml](https://github.com/go-openapi/ci-workflows) | `0.1.1` | `0.1.2` | | [go-openapi/ci-workflows/.github/workflows/release.yml](https://github.com/go-openapi/ci-workflows) | `0.1.1` | `0.1.2` | Updates `go-openapi/ci-workflows/.github/workflows/auto-merge.yml` from 0.1.1 to 0.1.2 - [Release notes](https://github.com/go-openapi/ci-workflows/releases) - [Commits](go-openapi/ci-workflows@d0b5019...9e70984) Updates `go-openapi/ci-workflows/.github/workflows/bump-release.yml` from 0.1.1 to 0.1.2 - [Release notes](https://github.com/go-openapi/ci-workflows/releases) - [Commits](go-openapi/ci-workflows@d0b5019...9e70984) Updates `go-openapi/ci-workflows/.github/workflows/codeql.yml` from 0.1.1 to 0.1.2 - [Release notes](https://github.com/go-openapi/ci-workflows/releases) - [Commits](go-openapi/ci-workflows@d0b5019...9e70984) Updates `go-openapi/ci-workflows/.github/workflows/contributors.yml` from 0.1.1 to 0.1.2 - [Release notes](https://github.com/go-openapi/ci-workflows/releases) - [Commits](go-openapi/ci-workflows@d0b5019...9e70984) Updates `go-openapi/ci-workflows/.github/workflows/go-test.yml` from 0.1.1 to 0.1.2 - [Release notes](https://github.com/go-openapi/ci-workflows/releases) - [Commits](go-openapi/ci-workflows@d0b5019...9e70984) Updates `go-openapi/ci-workflows/.github/workflows/scanner.yml` from 0.1.1 to 0.1.2 - [Release notes](https://github.com/go-openapi/ci-workflows/releases) - [Commits](go-openapi/ci-workflows@d0b5019...9e70984) Updates `go-openapi/ci-workflows/.github/workflows/release.yml` from 0.1.1 to 0.1.2 - [Release notes](https://github.com/go-openapi/ci-workflows/releases) - [Commits](go-openapi/ci-workflows@d0b5019...9e70984) --- updated-dependencies: - dependency-name: go-openapi/ci-workflows/.github/workflows/auto-merge.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: go-openapi/ci-workflows/.github/workflows/bump-release.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: go-openapi/ci-workflows/.github/workflows/codeql.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: go-openapi/ci-workflows/.github/workflows/contributors.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: go-openapi/ci-workflows/.github/workflows/go-test.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: go-openapi/ci-workflows/.github/workflows/scanner.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: go-openapi/ci-workflows/.github/workflows/release.yml dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

This reverts commit 03e90eb.

codecov-commenter · 2025-12-22T09:21:14Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 64.84018% with 77 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (master@be44553). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
schema.go	34.28%	23 Missing ⚠️
parameter.go	4.54%	21 Missing ⚠️
items.go	38.46%	8 Missing ⚠️
swagger.go	37.50%	5 Missing ⚠️
header.go	69.23%	4 Missing ⚠️
ref.go	66.66%	3 Missing and 1 partial ⚠️
response.go	76.47%	4 Missing ⚠️
expander.go	84.61%	1 Missing and 1 partial ⚠️
info.go	88.88%	1 Missing ⚠️
path_item.go	50.00%	1 Missing ⚠️
... and 4 more

Additional details and impacted files

@@            Coverage Diff            @@
##             master       #7   +/-   ##
=========================================
  Coverage          ?   66.90%           
=========================================
  Files             ?       29           
  Lines             ?     2360           
  Branches          ?        0           
=========================================
  Hits              ?     1579           
  Misses            ?      618           
  Partials          ?      163

Flag	Coverage Δ
oldstable	`66.90% <64.84%> (?)`
stable	`66.90% <64.84%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

dependabot bot and others added 30 commits March 22, 2024 10:02

Merge pull request go-openapi#204 from go-openapi/dependabot/go_modul…

de35272

…es/github.com/stretchr/testify-1.10.0 Bump github.com/stretchr/testify from 1.9.0 to 1.10.0

Relint

0201d0c

* updated linter config * fixed linting errors Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

re-enacted dependabot auto-merge

9deaa98

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

ci: fixed broken codecov coverage upload

6613744

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

ci: updated config for golangci-lint v2

bc386e3

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

chore(lint): updated linters, relinted code

c58668d

Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>

ci: fixed auto-merge

7c8c5e9

Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>

fix(lint): fixed false positives in tests (testifylint)

47a6321

Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>

chore: adopted swag v0.24.0 modules

e935aa9

go-openapi has introduced a new API to better insulate dependencies. We move to the new modules, even though at this stage this doesn't change our indirect dependencies. Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

chore(deps): updated dependencies

df12108

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

updated linting rules to go1.24

053aef4

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

updated yaml dependency to maintained package

e3141f6

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

chore(linting): removed nolint directives when the linter has fixed f…

3c1111c

…alse positives Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

chore: updated license marks in source files

9da6d8d

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

tests: replaced stretchr/testify by go-openapi/testify

f06cfff

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

chore: fix typos in comments

c14c0a6

Signed-off-by: Oleksandr Redko <oleksandr.red+github@gmail.com>

fredbi and others added 14 commits December 17, 2025 13:40

ci: remove redundant release workflow

b3b30bf

Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>

doc: fixed wrong links in docs

1beb4f3

Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>

Merge branch 'original_master' into PMM-14577-CVEs-fix

5684636

PMM-14577 Update go.

9aaf29b

PMM-14577 Lint.

ec798a9

PMM-14577 Format, lint.

e6e6be2

PMM-14577 Lint.

5904dd8

PMM-14577 Lint.

7f333b5

PMM-14577 Revert permissions.

5ba040a

PMM-14577 Test.

d614918

trigger

f4a5455

PMM-14577 Trigger.

03e90eb

Revert "PMM-14577 Trigger."

ec4a84e

This reverts commit 03e90eb.

JiriCtvrtka marked this pull request as ready for review December 22, 2025 09:16

PMM-14577 Put back Percona workflows.

2de7cf0

JiriCtvrtka added 10 commits December 22, 2025 10:22

PMM-14577 Update workflows Go.

1b78e72

PMM-14577 Lint.

56e544f

PMM-14577 Remove unsupported lints.

3f8774f

PMM-14577 Lint.

8112227

PMM-14577 Disable typecheck (too many errors in upstream).

63653e9

PMM-14577 Lint.

83bc57f

PMM-14577 Format.

1e52a56

PMM-14577 Align with Percona.

850e377

PMM-14577 Remove file.

989999f

PMM-14577 Align with Percona.

485c12f

JiriCtvrtka mentioned this pull request Dec 23, 2025

PMM-14577 Fix CVEs. percona/pmm#4848

Merged

ademidoff merged commit 15cbcf5 into Percona-Lab:master Jan 7, 2026
1 check passed

JiriCtvrtka mentioned this pull request Jan 7, 2026

PMM-14577 Fix CVEs. Percona-Lab/pmm-submodules#4168

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PMM-14577 CVEs fix.#7

PMM-14577 CVEs fix.#7
ademidoff merged 65 commits intoPercona-Lab:masterfrom
JiriCtvrtka:PMM-14577-CVEs-fix

JiriCtvrtka commented Dec 22, 2025

Uh oh!

codecov-commenter commented Dec 22, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

JiriCtvrtka commented Dec 22, 2025

Uh oh!

codecov-commenter commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

codecov-commenter commented Dec 22, 2025 •

edited

Loading