Skip to content

fix(security): update v3 dependencies - #182

Merged
moshloop merged 1 commit into
3.xfrom
fix/security-v3-dependency-updates-dmjvucfl7pyg
Nov 1, 2026
Merged

fix(security): update v3 dependencies#182
moshloop merged 1 commit into
3.xfrom
fix/security-v3-dependency-updates-dmjvucfl7pyg

Conversation

@moshloop

@moshloop moshloop commented Nov 1, 2026

Copy link
Copy Markdown
Member

What

  • Update Go to 1.26.10, x/net to 0.62.0, OpenTelemetry to 1.42.0, and required transitive modules
  • Resolve DOMPurify 3.4.17 within the existing range
  • Configure security-only maintenance, daily scans, and v3 release routing
  • Add release-policy tests and migration guidance

Why

  • Apply security dependency fixes while keeping CEL v0.31.0 and the v3 import path compatible

Notes

  • Validation passed: full Go tests, lint, ceval build and smoke, generated-language checks, web typechecks/tests/build, release analyzer and workflow syntax checks
  • Post-update govulncheck and production pnpm audit are clean

@moshloop
fix(security): maintain v3 with compatible dependency fixes
3aeb526 
Keep CEL v0.31.0 and the v3 import path while updating Go to 1.26.10, x/net to 0.62.0, OpenTelemetry to 1.42.0 and required transitive modules. Resolve DOMPurify 3.4.17 within the existing range.

Configure security-only maintenance, daily scans and v3 release routing. Add release-policy tests and documented migration guidance.

Validation: full Go tests, lint, ceval build and smoke, generated-language checks, web typechecks/tests/build, release analyzer and workflow syntax checks passed. Post-update govulncheck and production pnpm audit are clean.

Claude-Session-Id: 01a19670-c76b-7953-a4da-f9c1568eb9a2
@coderabbitai

coderabbitai Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 526296b2-d6a9-4838-9378-573b3c26f29d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@github-actions

github-actions Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Benchstat

Base: aa6958d61b6a529dbd0845584ce2dfe75cf27d84
Head: 3aeb526fcf2b7ab4ecae0dd7390815abbeb0d5ff

4 improvement(s)
Benchmark Metric Base Head Change p-value
CELProgramEvaluation/expression=scalar/optimized=true-4 sec/op 214 ns/op 208 ns/op -2.92% 0.000
CELProgramEvaluation/expression=scalar/optimized=false-4 sec/op 213 ns/op 207 ns/op -2.75% 0.000
CELEnvExtendCustomFunction-4 sec/op 72.8 us/op 71.1 us/op -2.31% 0.043
RunExpressionContext/cache=hit/environment=large-4 sec/op 10.9 us/op 10.8 us/op -0.51% 0.025
Full benchstat output 
goos: linux
goarch: amd64
pkg: github.com/flanksource/gomplate/v3
cpu: Intel(R) Xeon(R) Platinum 8370C CPU @ 2.80GHz
                                                                      │ bench-base.txt │           bench-head.txt           │
                                                                      │     sec/op     │   sec/op     vs base               │
CELEnvExtendCustomFunction-4                                               72.82µ ± 2%   71.13µ ± 2%  -2.31% (p=0.043 n=10)
CELProgramEvaluation/expression=scalar/optimized=false-4                   213.1n ± 1%   207.2n ± 1%  -2.75% (p=0.000 n=10)
CELProgramEvaluation/expression=scalar/optimized=true-4                    214.0n ± 0%   207.7n ± 1%  -2.92% (p=0.000 n=10)
CELProgramEvaluation/expression=list_optional_regex/optimized=false-4      5.912µ ± 2%   5.899µ ± 3%       ~ (p=0.739 n=10)
CELProgramEvaluation/expression=list_optional_regex/optimized=true-4       1.616µ ± 1%   1.622µ ± 1%       ~ (p=0.325 n=10)
CELProgramEvaluation/expression=comprehension/optimized=false-4            7.624µ ± 1%   7.603µ ± 1%       ~ (p=0.810 n=10)
CELProgramEvaluation/expression=comprehension/optimized=true-4             7.167µ ± 1%   7.180µ ± 2%       ~ (p=0.971 n=10)
RunExpressionNativeInput/input=map-4                                       2.854µ ± 1%   2.851µ ± 2%       ~ (p=0.898 n=10)
RunExpressionNativeInput/input=native_struct-4                             3.165µ ± 1%   3.165µ ± 2%       ~ (p=0.579 n=10)
RunExpressionContext/cache=hit/environment=small-4                         1.825µ ± 1%   1.818µ ± 4%       ~ (p=0.753 n=10)
RunExpressionContext/cache=hit/environment=large-4                         10.87µ ± 2%   10.81µ ± 0%  -0.51% (p=0.025 n=10)
RunExpressionContextCompile/cache=miss/environment=small-4                 309.5µ ± 2%   306.9µ ± 2%       ~ (p=0.481 n=10)
RunExpressionContextCompile/cache=miss/environment=large-4                 317.6µ ± 4%   315.4µ ± 4%       ~ (p=0.190 n=10)
CELEnvExtend/variables=1/functions=0-4                                     5.011µ ± 1%   5.044µ ± 3%       ~ (p=0.247 n=10)
CELEnvExtend/variables=10/functions=0-4                                    6.781µ ± 2%   6.813µ ± 3%       ~ (p=0.579 n=10)
CELEnvExtend/variables=100/functions=0-4                                   22.14µ ± 2%   22.22µ ± 4%       ~ (p=0.271 n=10)
Serialize/items=10/native_values=true-4                                    33.67µ ± 1%   33.72µ ± 1%       ~ (p=0.436 n=10)
Serialize/items=100/native_values=true-4                                   316.9µ ± 0%   317.2µ ± 1%       ~ (p=0.796 n=10)
Serialize/items=1000/native_values=true-4                                  3.201m ± 0%   3.212m ± 0%       ~ (p=0.052 n=10)
Serialize/items=10000/native_values=true-4                                 35.30m ± 1%   35.32m ± 1%       ~ (p=0.739 n=10)
Serialize_NoNativeTypes/items=100/native_values=false-4                    87.20µ ± 1%   87.70µ ± 1%       ~ (p=0.529 n=10)
Serialize_NoNativeTypes/items=1000/native_values=false-4                   880.3µ ± 1%   885.4µ ± 1%       ~ (p=0.218 n=10)
Serialize_NoNativeTypes/items=10000/native_values=false-4                  8.837m ± 2%   8.883m ± 1%       ~ (p=0.739 n=10)
geomean                                                                    30.91µ        30.82µ       -0.30%

                                                                      │ bench-base.txt │            bench-head.txt             │
                                                                      │      B/op      │     B/op      vs base                 │
CELEnvExtendCustomFunction-4                                              45.19Ki ± 0%   45.19Ki ± 0%       ~ (p=1.000 n=10)
CELProgramEvaluation/expression=scalar/optimized=false-4                    64.00 ± 0%     64.00 ± 0%       ~ (p=1.000 n=10) ¹
CELProgramEvaluation/expression=scalar/optimized=true-4                     64.00 ± 0%     64.00 ± 0%       ~ (p=1.000 n=10) ¹
CELProgramEvaluation/expression=list_optional_regex/optimized=false-4     4.464Ki ± 0%   4.463Ki ± 0%       ~ (p=0.448 n=10)
CELProgramEvaluation/expression=list_optional_regex/optimized=true-4        741.0 ± 0%     741.0 ± 0%       ~ (p=0.582 n=10)
CELProgramEvaluation/expression=comprehension/optimized=false-4           2.822Ki ± 0%   2.822Ki ± 0%       ~ (p=1.000 n=10) ¹
CELProgramEvaluation/expression=comprehension/optimized=true-4            2.438Ki ± 0%   2.438Ki ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionNativeInput/input=map-4                                        808.0 ± 0%     808.0 ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionNativeInput/input=native_struct-4                             1000.0 ± 0%    1000.0 ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionContext/cache=hit/environment=small-4                          664.0 ± 0%     664.0 ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionContext/cache=hit/environment=large-4                        2.445Ki ± 0%   2.445Ki ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionContextCompile/cache=miss/environment=small-4                203.5Ki ± 0%   203.5Ki ± 0%       ~ (p=0.699 n=10)
RunExpressionContextCompile/cache=miss/environment=large-4                205.5Ki ± 0%   205.5Ki ± 0%       ~ (p=0.986 n=10)
CELEnvExtend/variables=1/functions=0-4                                    3.352Ki ± 0%   3.352Ki ± 0%       ~ (p=1.000 n=10) ¹
CELEnvExtend/variables=10/functions=0-4                                   5.031Ki ± 0%   5.031Ki ± 0%       ~ (p=1.000 n=10) ¹
CELEnvExtend/variables=100/functions=0-4                                  22.50Ki ± 0%   22.50Ki ± 0%       ~ (p=1.000 n=10) ¹
Serialize/items=10/native_values=true-4                                   11.06Ki ± 0%   11.06Ki ± 0%       ~ (p=1.000 n=10) ¹
Serialize/items=100/native_values=true-4                                  95.51Ki ± 0%   95.51Ki ± 0%       ~ (p=0.128 n=10)
Serialize/items=1000/native_values=true-4                                 952.0Ki ± 0%   952.0Ki ± 0%       ~ (p=0.696 n=10)
Serialize/items=10000/native_values=true-4                                10.01Mi ± 0%   10.03Mi ± 0%       ~ (p=0.469 n=10)
Serialize_NoNativeTypes/items=100/native_values=false-4                   36.33Ki ± 0%   36.33Ki ± 0%       ~ (p=1.000 n=10)
Serialize_NoNativeTypes/items=1000/native_values=false-4                  365.6Ki ± 0%   365.6Ki ± 0%       ~ (p=0.635 n=10)
Serialize_NoNativeTypes/items=10000/native_values=false-4                 3.584Mi ± 0%   3.584Mi ± 0%       ~ (p=0.753 n=10)
geomean                                                                   12.95Ki        12.95Ki       +0.00%
¹ all samples are equal

                                                                      │ bench-base.txt │            bench-head.txt            │
                                                                      │   allocs/op    │  allocs/op   vs base                 │
CELEnvExtendCustomFunction-4                                                100.0 ± 0%    100.0 ± 0%       ~ (p=1.000 n=10) ¹
CELProgramEvaluation/expression=scalar/optimized=false-4                    3.000 ± 0%    3.000 ± 0%       ~ (p=1.000 n=10) ¹
CELProgramEvaluation/expression=scalar/optimized=true-4                     3.000 ± 0%    3.000 ± 0%       ~ (p=1.000 n=10) ¹
CELProgramEvaluation/expression=list_optional_regex/optimized=false-4       105.0 ± 0%    105.0 ± 0%       ~ (p=1.000 n=10) ¹
CELProgramEvaluation/expression=list_optional_regex/optimized=true-4        23.00 ± 0%    23.00 ± 0%       ~ (p=1.000 n=10) ¹
CELProgramEvaluation/expression=comprehension/optimized=false-4             92.00 ± 0%    92.00 ± 0%       ~ (p=1.000 n=10) ¹
CELProgramEvaluation/expression=comprehension/optimized=true-4              82.00 ± 0%    82.00 ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionNativeInput/input=map-4                                        27.00 ± 0%    27.00 ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionNativeInput/input=native_struct-4                              26.00 ± 0%    26.00 ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionContext/cache=hit/environment=small-4                          20.00 ± 0%    20.00 ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionContext/cache=hit/environment=large-4                          101.0 ± 0%    101.0 ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionContextCompile/cache=miss/environment=small-4                 2.258k ± 0%   2.258k ± 0%       ~ (p=1.000 n=10) ¹
RunExpressionContextCompile/cache=miss/environment=large-4                 2.341k ± 0%   2.341k ± 0%       ~ (p=1.000 n=10) ¹
CELEnvExtend/variables=1/functions=0-4                                      60.00 ± 0%    60.00 ± 0%       ~ (p=1.000 n=10) ¹
CELEnvExtend/variables=10/functions=0-4                                     79.00 ± 0%    79.00 ± 0%       ~ (p=1.000 n=10) ¹
CELEnvExtend/variables=100/functions=0-4                                    181.0 ± 0%    181.0 ± 0%       ~ (p=1.000 n=10) ¹
Serialize/items=10/native_values=true-4                                     268.0 ± 0%    268.0 ± 0%       ~ (p=1.000 n=10) ¹
Serialize/items=100/native_values=true-4                                   2.518k ± 0%   2.518k ± 0%       ~ (p=1.000 n=10) ¹
Serialize/items=1000/native_values=true-4                                  25.80k ± 0%   25.80k ± 0%       ~ (p=0.675 n=10)
Serialize/items=10000/native_values=true-4                                 264.8k ± 0%   264.9k ± 0%       ~ (p=0.141 n=10)
Serialize_NoNativeTypes/items=100/native_values=false-4                     911.0 ± 0%    911.0 ± 0%       ~ (p=1.000 n=10) ¹
Serialize_NoNativeTypes/items=1000/native_values=false-4                   9.757k ± 0%   9.757k ± 0%       ~ (p=1.000 n=10)
Serialize_NoNativeTypes/items=10000/native_values=false-4                  100.1k ± 0%   100.1k ± 0%       ~ (p=0.583 n=10)
geomean                                                                     290.0         290.0       +0.00%
¹ all samples are equal

@socket-security

socket-security Bot commented Nov 1, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgolang/​golang.org/​x/​tools@​v0.44.0 ⏵ v0.51.075 +1100100100100
Updatedgolang/​golang.org/​x/​text@​v0.37.0 ⏵ v0.43.077 +1100100100100

View full report

@moshloop
moshloop marked this pull request as ready for review November 1, 2026 13:24
@moshloop
moshloop merged commit 332e0b1 into 3.x Nov 1, 2026
11 checks passed
@moshloop
moshloop deleted the fix/security-v3-dependency-updates-dmjvucfl7pyg branch November 1, 2026 13:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@moshloop