From 833e371c1c34de6bdb95ae82b6e48b964e856d28 Mon Sep 17 00:00:00 2001 From: Alexandr Dejneka Date: Thu, 12 Nov 2026 11:22:29 +0100 Subject: [PATCH 1/6] Bump Go to 1.26.9 to fix stdlib CVEs Co-Authored-By: Claude Sonnet 5.5 --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 0b57566..25710c0 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/jamf/helm-github -go 1.24.1 +go 1.26.9 require ( github.com/Masterminds/semver/v3 v3.4.0 From 181da0dffff9699ed701a4ce2d2ddd1bf9e24baf Mon Sep 17 00:00:00 2001 From: Alexandr Dejneka Date: Thu, 12 Nov 2026 11:26:35 +0100 Subject: [PATCH 2/6] Bump Go to 1.26.11 (net/http, crypto/x509 fixes) Co-Authored-By: Claude Sonnet 5.5 --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 25710c0..de20f20 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/jamf/helm-github -go 1.26.9 +go 1.26.11 require ( github.com/Masterminds/semver/v3 v3.4.0 From 17523602fbb174057c0ad6df07a579e0b47ba183 Mon Sep 17 00:00:00 2001 From: Alexandr Dejneka Date: Thu, 12 Nov 2026 11:27:43 +0100 Subject: [PATCH 3/6] Bump plugin version to 0.1.14 Co-Authored-By: Claude Sonnet 5.5 --- plugin.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugin.yaml b/plugin.yaml index 17a1949..86d1676 100644 --- a/plugin.yaml +++ b/plugin.yaml @@ -1,5 +1,5 @@ name: "github" -version: "0.1.13" +version: "0.1.14" usage: "Manage chart repositories on Github" description: |- Provides Github Protocol Support From 2afad13dcefe99bf139ffac41e6be9efb8b3c778 Mon Sep 17 00:00:00 2001 From: Alexandr Dejneka Date: Thu, 12 Nov 2026 11:29:36 +0100 Subject: [PATCH 4/6] Bump oauth2 to v0.38.0 and semver to v3.5.0 Co-Authored-By: Claude Sonnet 5.5 --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index de20f20..8dc29d9 100644 --- a/go.mod +++ b/go.mod @@ -3,9 +3,9 @@ module github.com/jamf/helm-github go 1.26.11 require ( - github.com/Masterminds/semver/v3 v3.4.0 + github.com/Masterminds/semver/v3 v3.5.0 github.com/google/go-github/v82 v82.0.0 - golang.org/x/oauth2 v0.34.0 + golang.org/x/oauth2 v0.38.0 sigs.k8s.io/yaml v1.6.0 ) diff --git a/go.sum b/go.sum index 3c0bc45..b17f622 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,5 @@ -github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= -github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE= +github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= @@ -22,8 +22,8 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= go.yaml.in/yaml/v3 v3.0.3 h1:bXOww4E/J3f66rav3pX3m8w6jDE4knZjGOw8b5Y6iNE= go.yaml.in/yaml/v3 v3.0.3/go.mod h1:tBHosrYAkRZjRAOREWbDnBXUf08JOwYq++0QNwQiWzI= -golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= -golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= +golang.org/x/oauth2 v0.38.0 h1:uW7XQbcu1eoiQS7uMJvLOjPMl04bTbmY1VeRPxvbspI= +golang.org/x/oauth2 v0.38.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= From cb00093c6a64c2d961b2471550fee21204d945e0 Mon Sep 17 00:00:00 2001 From: Alexandr Dejneka Date: Thu, 12 Nov 2026 11:30:56 +0100 Subject: [PATCH 5/6] Bump golangci-lint to v2.15 (needs Go 1.26 build) Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/golangci-lint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 71ae265..c37b33f 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -15,4 +15,4 @@ jobs: - name: golangci-lint uses: golangci/golangci-lint-action@v9 with: - version: v2.8 + version: v2.15 From dd0b6129972706953888aab39467d5110323437a Mon Sep 17 00:00:00 2001 From: Alexandr Dejneka Date: Thu, 12 Nov 2026 11:38:32 +0100 Subject: [PATCH 6/6] Suppress gosec G703 false positives on cache paths Co-Authored-By: Claude Sonnet 5.5 --- main.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/main.go b/main.go index 68d22d5..80f6509 100644 --- a/main.go +++ b/main.go @@ -137,7 +137,7 @@ func getArchiveDigest(uri string) string { func getCachedIndexFile(uri string) (helm.IndexFile, bool) { _, r := parseOwnerRepository(uri) - bytes, err := os.ReadFile(path.Join(cacheDirBase, r+"-index.yaml")) + bytes, err := os.ReadFile(path.Join(cacheDirBase, r+"-index.yaml")) //nolint:gosec // G703: r is a single path segment (split on "/"), so the name stays inside cacheDirBase if err != nil { return helm.IndexFile{}, false } @@ -225,15 +225,15 @@ func fetchIndexFile(ctx context.Context, uri string) (helm.IndexFile, error) { func openCacheFile(uri string) (*os.File, error) { artifactName := parseArtifactName(uri) chartPath := path.Join(chartsCacheDir, artifactName+".tgz") - _, err := os.Stat(chartPath) + _, err := os.Stat(chartPath) //nolint:gosec // G703: artifactName is the text after the last "/", so it cannot contain a separator if err != nil { - create, err := os.Create(chartPath) + create, err := os.Create(chartPath) //nolint:gosec // G703: artifactName is the text after the last "/", so it cannot contain a separator if err != nil { return nil, err } return create, nil } - open, err := os.OpenFile(chartPath, os.O_RDWR, 0o666) + open, err := os.OpenFile(chartPath, os.O_RDWR, 0o666) //nolint:gosec // G703: artifactName is the text after the last "/", so it cannot contain a separator if err != nil { return nil, err }