Repository navigation
maintenance: update Go security patch and audit vulnerable dependencies #255
Description
Affected page, module, or tool
All Go modules, toolchain configuration, and dependency metadata.
Affected modules
powertools-lambda-go, datamasking/kms, validation, tracer, tracer/xray, eventhandler/http/tracer, examples, integration
Request or question
Upgrade the minimum Go patch to 1.27.3, including the published crypto/x509 fix GO-2026-6809 (CVE-2026-111943), audit each independent module against the current Go vulnerability database, and update vulnerable direct/transitive dependencies including golang.org/x/crypto where selected. The installed development toolchain is Go 1.27.1. Do not confuse workspace minimum-version selection with standalone module safety.
Completion criteria
- Preserve JSON v2, CGO_ENABLED=0, dependency-free root Commons, module boundaries, and the frozen X-Ray adapter scope.
- Record module/package/symbol reachability and distinguish unused vulnerable packages from reachable vulnerabilities.
- Update vulnerable dependency versions without unrelated broad upgrades; tidy through tools/modules.py.
- Verify packaged modules, Linux amd64/arm64 artifacts, local service/runtime suites, documentation and release tooling through CI.
- Review the final PR diff and exact checks before merge.
- Prepare, review, and publish the next unified stable release with one GitHub Release and all maintained module tags. Do not rewrite v1.2.0 or other published versions.
Before submitting
- I searched existing issues and documentation.
- I removed credentials and private data from this request.
Activity
jinxiao commentedon Oct 22, 2026
Scope accepted by the maintainer: audit all independent modules, apply the current Go 1.27 security patch and minimal dependency fixes, verify and review the PR, then prepare and publish the unified stable cohort. Public upstream advisories only; no cloud testing or unrelated feature work.
jinxiao commentedon Oct 23, 2026
Review found an additional merge blocker in full CI run 39872903951: kafka/avro selects archived github.com/hamba/avro/v2 v2.31.0, and GO-2026-5046, GO-2026-5047, and GO-2026-5048 mark all upstream symbols affected with no fixed Hamba version. Existing first-party collection bounds mitigate important paths, but upgrading Go/net alone cannot clear this dependency. Scope accepted: migrate the private codec dependency to maintained github.com/iskorotkov/avro/v2 v2.34.0, explicitly configure byte/array/map bounds, retain existing decode contracts, and run malformed-input plus TypeScript-reference regression coverage. No suppression or custom vulnerability database will be used.
jinxiao commentedon Oct 23, 2026
Completed security upgrade and publication acceptance:
Evidence: publication acceptance, security acceptance.
Known non-blocking follow-up: P3 #262 affects the root internal changed-file disclosure, not source packaging. Production scan conclusions do not cover unused upstream tool packages. The frozen X-Ray adapter was patched in source but remains excluded from new publication. Lambda runtime execution covers amd64; arm64 is cross-built/scanned. No race or AWS cloud tests were performed. Browser/pkg.go.dev presentation remains an owner check.