Remediate critical Dependabot vulnerabilities in actions-runner-controller - #29
Remediate critical Dependabot vulnerabilities in actions-runner-controller#29devin-ai-integration[bot] wants to merge 2 commits into
Conversation
Bump golang.org/x/crypto from v0.1.0 to v0.31.0 (GHSA-v778-237x-gjrc). Story: https://app.shortcut.com/fireflies/story/109239
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
🔍 PR Complexity Assessment🟢 Risk Score: 2/10
📝 SummarySecurity remediation PR that bumps golang.org/x/crypto from v0.1.0 to v0.31.0 to fix a critical authentication bypass vulnerability (GHSA-v778-237x-gjrc), along with related indirect dependency updates for golang.org/x/{net,sys,term,text}. 📊 Lines Analysis
💡 RecommendationLow-risk security remediation. Verify CI passes (build, vet, unit tests) and confirm the Dependabot alert is resolved after merge. The dependency bump is straightforward with no functional code changes. This assessment is automated and should be used as a guide. Please use your judgment when reviewing. |
golang.org/x/crypto v0.31.0 requires Go 1.20+ (uses crypto/ecdh introduced in Go 1.20). Bump go.mod, Dockerfile, and CI workflows from Go 1.19/1.18.2 to Go 1.22 so the security fix compiles. Also bump golangci-lint to v1.59.1 to support the newer toolchain.
|
Shortcut story archived (PR closed without merge): https://app.shortcut.com/fireflies/story/109239 |
3 participants
What does this PR do?
Remediates a critical Dependabot vulnerability in
firefliesai/actions-runner-controllerby bumpinggolang.org/x/cryptofromv0.1.0tov0.31.0.golang.org/x/cryptov0.1.0→v0.31.0(fixes GHSA-v778-237x-gjrc — "Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass")golang.org/x/crypto v0.31.0requires Go 1.20+ (it usescrypto/ecdh, introduced in Go 1.20). The repo was pinned to Go 1.19 / 1.18.2, so this PR also bumps the toolchain to Go 1.22 in every place that builds the controller:go.mod—go 1.19→go 1.22Dockerfile—golang:1.19.4→golang:1.22.10.github/workflows/golangci-lint.yaml—go-version: 1.19→'1.22',golangci-lint v1.49.0→v1.59.1(older linter doesn't support Go 1.20+).github/workflows/validate-arc.yaml—go-version: '1.19'→'1.22'.github/workflows/publish-arc.yaml—go-version: '1.18.2'→'1.22'go mod tidyalso incidentally re-pinned relatedgolang.org/x/{net,sys,term,text}indirect modules to the versions that ship withcrypto v0.31.0. No application code changes; the bump stays within thev0.xSemVer major for each module.go build ./...,go vet ./..., andgolangci-lint run(with v1.59.1 on Go 1.22) all pass cleanly locally.Type of change
(Security / dependency remediation — no functional code changes. Toolchain bump from Go 1.19 → 1.22 is required by the security fix.)
How should this be manually tested?
lintandCodeQL/Analyze (go)checks are green on this PR.golang.org/x/cryptois auto-dismissed once this PR merges tomaster.docker build .) and run it against a test cluster to confirm runner orchestration still works end-to-end.Known follow-up:
Test ARCCI checkThe
Test ARCworkflow runsmake test, which invokescontroller-gen v0.7.0(pinned in theMakefile).controller-gen v0.7.0has a known incompatibility with Go 1.20+ and panics duringmake generatewithgo/typesnil pointer dereference. This panic exists onmasterthe moment Go is bumped past 1.19 — it is not caused by the crypto bump itself.Fixing the panic requires bumping
controller-gen(e.g. to v0.14.0+), which regenerates ~53k lines of CRD YAML underconfig/crd/bases/. That is well outside the scope of a single CVE remediation, so it has been deliberately deferred to a separate follow-up PR. All CI checks on this PR are marked[optional]andTest ARCfailing here does not block merge.Any background context you want to provide beyond Shortcut?
Devin session
Slack thread
Shortcut story
Requested by: caio@fireflies.ai (caiocampoos)
Any Security implications
This PR is itself the security remediation — it closes GHSA-v778-237x-gjrc, where misuse of
golang.org/x/crypto/ssh.ServerConfig.PublicKeyCallbackcould allow an attacker to authenticate as a user whose public key they merely know but do not control. The fix is a dependency bump that removes the vulnerable code paths from this repository's transitive dependency graph.Link to Devin session: https://app.devin.ai/sessions/55da6d919f6a44b9b33dbf5ade690617
Requested by: @caiocampoos