Repository navigation
chore(deps): update github-actions (non-major) - #71
Merged
Merged
Conversation
1 of 4 tasks
fclairamb
added a commit
that referenced
this pull request
Oct 11, 2026
## What & why Deals with every open alert on the Security tab. **Fixed in this PR** - Dependabot #9: `github.com/moby/go-archive` v0.2.0 → v0.3.0 (tar archive can write outside the extraction dir). - Dependabot #10: `github.com/moby/sys/user` v0.4.0 → v0.4.1 (unbounded parsing DoS). - CodeQL #65 (clear-text logging, grdp `sec.go`): `sendFlagged` logged the plaintext PDU in hex at debug level, and the client info PDU carries the RDP password. It now logs the length only. Also removed the debug logs of the client random and the four NTLM signing/sealing keys (same class of leak, not flagged). - CodeQL #61 (allocation-size overflow, `credentials/secret_fields.go`): map size hint is now `max(a, b)` instead of `a + b`. Same change on `MergePatch`. **Dismissed (no code change)** - #72-#81, #68-#71 (weak crypto / weak hashing in vendored `third_party/grdp`): RC4, MD4, MD5, SHA-1 and DES are mandated by RDP standard security and NTLM. Same reasoning as the VNC DES alerts #94/#95. - #31 (MD5 in `checksip`): SIP digest auth (RFC 3261/2617) is MD5. - #33 (SHA-256 on password, `passwords/bcrypt.go`): pre-hash before bcrypt to bypass the 72-byte limit. bcrypt is the slow hash. - #54 (InsecureSkipVerify, `checkrdp`): leaf-only certificate inspection by design, same as #62/#93. - #47/#48 (cookie Secure, `statuspagelock`): `Secure: httpx.IsTLS(req)`, same as #44/#59. - #39 (request forgery, `jmap/client.go`): the JMAP session URL is set by a super admin (instance operator), and reaching their own mail server, often on the LAN, is the feature. Same as the Freebox alert #35. - #17 (clear-text logging, `slack/commands.go`): map-value taint through the check config, the password never reaches the log. Same as #18. ## How to test - `go build ./...` and `go test ./internal/crypto/credentials/ ./internal/checkers/checkrdp/...` in `server/` - `go test ./...` in `server/third_party/grdp` - `golangci-lint` v2.14.0 on `internal/crypto/...`: 0 issues ## Checklist - [x] `go build`, lint and tests pass on the touched packages (full `make test` left to CI) - [ ] Tests added or updated for the change (log-only and size-hint changes, existing tests cover behaviour) - [ ] Docs updated (not user-visible) - [ ] Schema changes (none) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.1.0→v4.2.0v6.0.0→v6.1.0Release Notes
docker/login-action (docker/login-action)
v4.2.0Compare Source
Full Changelog: docker/login-action@v4.1.0...v4.2.0
docker/metadata-action (docker/metadata-action)
v6.1.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.