Repository navigation
chore(deps): upgrade go dependencies, including okapi v1.1.0 - #279
Merged
Merged
Conversation
Bump jkaninda/okapi v1.0.0 => v1.1.0, whose release fixes a security issue where Next still ran the handler after an Abort, and adds Context.IsAborted. Posta's middleware and handlers only use the Abort helpers as terminal returns, so the behavior change is compatible. Also bump the remaining upgradable modules with go get -u ./...: kin-openapi v0.151.0, go-jose/v4 v4.1.6, go-openapi/jsonpointer v1.0.2, golang.org/x/net v0.61.0, golang.org/x/mod v0.42.0, and assorted indirect patches. go build, go vet and go test ./... all pass. Akili-Task: tsk_q7k6qiwly6bwlm2qu2sy Akili-Agent: goldfish
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
go get -u ./...+go mod tidy, upgrading every module with an available update — 20 in total. Onlygo.modandgo.sumchanged; no source changes were needed.Headline bump: github.com/jkaninda/okapi v1.0.0 → v1.1.0 (the reason for this PR).
Other direct bumps:
Notable indirect bumps: cloud.google.com/go/compute/metadata v0.10.0, andybalholm/cascadia v1.3.5, getkin/kin-openapi v0.151.0, go-jose/go-jose/v4 v4.1.6, go-openapi/jsonpointer v1.0.2, goccy/go-json v0.11.2, jackc/puddle/v2 v2.2.3, mattn/go-colorable v0.1.16, mattn/go-isatty v0.0.24, mattn/go-runewidth v0.0.31, olekukonko/{errors v1.3.0, ll v0.1.9, tablewriter v1.1.5}, prometheus/common v0.72.1, santhosh-tekuri/jsonschema/v6 v6.0.3, golang.org/x/time v0.16.0.
okapi v1.1.0 compatibility
v1.1.0 is a minor release whose one behavior change is a security fix:
Context.Nextno longer runs the remaining handler chain once an Abort helper has answered the request (previously a middleware that aborted and then calledNextwould still execute the handler behind the error response). It also addsContext.IsAborted().I audited Posta's usage: every middleware and handler uses the Abort helpers (
AbortUnauthorized,AbortForbidden, …) strictly as terminalreturnstatements — no abort-then-Next()pattern exists — so the fix is behavior-compatible and no code changes were required. TheJWTAuth/OnUnauthorizedflow ininternal/middlewaresis likewise unaffected.How it was tested
go build ./...— cleango vet ./...— cleango test ./...— all packages pass (same suite CI runs)golangci-lint is not installed on the build host, so lint is left to the CI workflow.
Opened by Akili agent goldfish · task
tsk_q7k6qiwly6bwlm2qu2sy