agentic-forges/forgejo-mcp
Watch
5
0
Fork
You've already forked forgejo-mcp
 0
Code Issues 9 Pull requests 6 Projects Releases 32 Packages 1 Activity

fix: bump x/net + jsonparser to clear govulncheck advisories #145

Merged
goern merged 0 commits from refs/pull/145/head into main 2026-05-25 07:26:27 +00:00
Conversation 4 Commits - Files changed -
goern commented 2026-05-24 11:07:40 +00:00 (Migrated from codeberg.org)
Copy link

Summary

ci.yml run #151 flagged govulncheck advisories. Local scan (govulncheck v1.3.0) showed 7 findings, 0 of them symbol-reachable from forgejo-mcp code. Default govulncheck exits 0 on non-reachable findings, so the runner failure mode may be a stricter flag/version — this PR clears the advisories regardless so the question becomes moot.

Findings cleared

ID Module From → To Tier
GO-2026-5026 golang.org/x/net/idna v0.54.0 → v0.55.0 package
GO-2026-5025 golang.org/x/net/html v0.54.0 → v0.55.0 module
GO-2026-5027 golang.org/x/net/html v0.54.0 → v0.55.0 module
GO-2026-5028 golang.org/x/net/html v0.54.0 → v0.55.0 module
GO-2026-5029 golang.org/x/net/html v0.54.0 → v0.55.0 module
GO-2026-5030 golang.org/x/net/html v0.54.0 → v0.55.0 module
GO-2026-4514 github.com/buger/jsonparser v1.1.1 → v1.1.2 package

Why a direct require for jsonparser

buger/jsonparser arrives 4 hops deep:

codeberg.org/goern/forgejo-mcp/v2/cmd
  └─ github.com/mark3labs/mcp-go/mcp
       └─ github.com/invopop/jsonschema
            └─ github.com/wk8/go-ordered-map/v2
                 └─ github.com/buger/jsonparser

Without a direct require, go mod tidy keeps the transitively-pinned v1.1.1. go get github.com/buger/jsonparser@v1.1.2 promotes it to a direct require, overriding the pin. When wk8/go-ordered-map eventually bumps, the direct require can be removed.

Verification

$ govulncheck -show verbose ./...
…
No vulnerabilities found.
  • make build — green
  • go test ./... — all packages green (incl. test/race)

Test plan

  • ci.yml run on this PR passes the govulncheck step
  • Tekton go-ci task also passes (mirrors the same scan)

Not addressed here

The underlying ambiguity — was govulncheck really the failing step in run #151? — is still unconfirmed because Codeberg's action log isn't publicly fetchable via WebFetch. If the failure resurfaces after this merge, capture the failing step log and file under forgejo-mcp-e9i (parent investigation bead).

Refs forgejo-mcp-p1p.

## Summary ci.yml run [#151](https://codeberg.org/goern/forgejo-mcp/actions/runs/151) flagged govulncheck advisories. Local scan (govulncheck v1.3.0) showed 7 findings, 0 of them symbol-reachable from forgejo-mcp code. Default govulncheck exits 0 on non-reachable findings, so the runner failure mode may be a stricter flag/version — this PR clears the advisories regardless so the question becomes moot. ## Findings cleared | ID | Module | From → To | Tier | |---|---|---|---| | GO-2026-5026 | `golang.org/x/net/idna` | `v0.54.0 → v0.55.0` | package | | GO-2026-5025 | `golang.org/x/net/html` | `v0.54.0 → v0.55.0` | module | | GO-2026-5027 | `golang.org/x/net/html` | `v0.54.0 → v0.55.0` | module | | GO-2026-5028 | `golang.org/x/net/html` | `v0.54.0 → v0.55.0` | module | | GO-2026-5029 | `golang.org/x/net/html` | `v0.54.0 → v0.55.0` | module | | GO-2026-5030 | `golang.org/x/net/html` | `v0.54.0 → v0.55.0` | module | | GO-2026-4514 | `github.com/buger/jsonparser` | `v1.1.1 → v1.1.2` | package | ## Why a direct require for `jsonparser` `buger/jsonparser` arrives 4 hops deep: ``` codeberg.org/goern/forgejo-mcp/v2/cmd └─ github.com/mark3labs/mcp-go/mcp └─ github.com/invopop/jsonschema └─ github.com/wk8/go-ordered-map/v2 └─ github.com/buger/jsonparser ``` Without a direct `require`, `go mod tidy` keeps the transitively-pinned v1.1.1. `go get github.com/buger/jsonparser@v1.1.2` promotes it to a direct require, overriding the pin. When `wk8/go-ordered-map` eventually bumps, the direct require can be removed. ## Verification ```text $ govulncheck -show verbose ./... … No vulnerabilities found. ``` - `make build` — green - `go test ./...` — all packages green (incl. `test/race`) ## Test plan - [ ] ci.yml run on this PR passes the govulncheck step - [ ] Tekton go-ci task also passes (mirrors the same scan) ## Not addressed here The underlying ambiguity — *was govulncheck really the failing step in run #151?* — is still unconfirmed because Codeberg's action log isn't publicly fetchable via WebFetch. If the failure resurfaces after this merge, capture the failing step log and file under `forgejo-mcp-e9i` (parent investigation bead). Refs forgejo-mcp-p1p.
op1st-gitops commented 2026-05-24 11:07:45 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/code-scans-wvxrp is running.

Starting Pipelinerun code-scans-wvxrp in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-wvxrp -f

op1st Pipelines as Code/code-scans-wvxrp is running. Starting Pipelinerun <b>[code-scans-wvxrp](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-wvxrp)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-wvxrp) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-wvxrp -f</code>
op1st-gitops commented 2026-05-24 11:07:45 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/on-pull-request- has failed.
There was an error creating the PipelineRun: on-pull-request-

cannot use the API on the provider platform to create a in_progress status:

op1st Pipelines as Code/on-pull-request- has <b>failed</b>. There was an error creating the PipelineRun: <b>on-pull-request-</b> cannot use the API on the provider platform to create a in_progress status:
op1st-gitops commented 2026-05-24 11:08:05 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/code-scans-wvxrp has successfully validated your commit.

Task Statuses:

StatusDurationName
Succeeded 9 seconds

fetch-source

Succeeded 7 seconds

gitleaks-version

Succeeded 10 seconds

gitleaks

op1st Pipelines as Code/code-scans-wvxrp has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-wvxrp">code-scans-wvxrp</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-wvxrp/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>7 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-wvxrp/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-wvxrp/logs/gitleaks) </td></tr> </table>
goern commented 2026-05-25 07:24:57 +00:00 (Migrated from codeberg.org)
Copy link

Auto-labeled via codeberg-label skill (sonnet subagent).

  • Kind/Security — PR clears govulncheck advisories by bumping vulnerable dependencies (x/net, jsonparser).
  • Priority/Critical — security fix scope.

Tracked locally as forgejo-mcp-02o.

Auto-labeled via `codeberg-label` skill (sonnet subagent). - **Kind/Security** — PR clears govulncheck advisories by bumping vulnerable dependencies (`x/net`, `jsonparser`). - **Priority/Critical** — security fix scope. Tracked locally as `forgejo-mcp-02o`.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
Compat/Breaking
Breaking change that won't be backward compatible

  
Kind/Bug
Something is not working

  
Kind/Documentation
Documentation changes

  
Kind/Enhancement
Improve existing functionality

  
Kind/Feature
New functionality

  
Kind/OpenSpec
OpenSpec change proposal / spec-driven work

  
Kind/Security
This is security issue

  
Kind/Testing
Issue or pull request related to testing

  
Priority/Critical
The priority is critical

  
Priority/High
The priority is high

  
Priority/Low
The priority is low

  
Priority/Medium
The priority is medium

  
RFC - Request For Comments
Request For Comments — design/spec open for feedback before implementation

  
Reviewed/Confirmed
Issue has been confirmed

  
Reviewed/Duplicate
This issue or pull request already exists

  
Reviewed/Invalid
Invalid issue

  
Reviewed/Won't Fix
This issue won't be fixed

  
Status/Abandoned
Somebody has started to work on this but abandoned work

  
Status/Blocked
Something is blocking this issue or pull request

  
Status/Need More Info
Feedback is required to reproduce issue or to continue work

  
hermes-attempted
Hermes attempted but produced no changes

  
hermes-needs-clarification
Quality gate flagged, needs human input

  
hermes-ready
Ready for hermes to process

  
hermes-review
Hermes PR awaiting review

  
hermes-wip
Hermes is working on this

  
human-required
Hermes gave up after 3 attempts

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/OpenSpec
Kind/Security
Kind/Testing
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
RFC - Request For Comments
Reviewed/Confirmed
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Status/Abandoned
Status/Blocked
Status/Need More Info
hermes-attempted
hermes-needs-clarification
hermes-ready
hermes-review
hermes-wip
human-required
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
agentic-forges/forgejo-mcp!145
No description provided.