33302539011
28%
main: 31%

Ran 30 Aug 2026 08:53AM UTC

Jobs 1

Files 11

Run time 1min

Badge

Embed ▾

Committed 30 Aug 2026 08:49AM UTC coverage: 27.691%. Remained the same

Build # 33302539011

Build Type

Pull #379

github

Committed by

claude

Commit Message

fix(deps): bump github.com/buger/jsonparser to v1.6.1 (fixes #376)

`go.mod` pinned `github.com/buger/jsonparser v1.1.1` (released
2021-01-08), which is vulnerable to CVE-2026-32285: the `Delete`
function does not validate the start/end offsets before slicing the
input byte slice, so malformed JSON can trigger a runtime panic
(slice bounds out of range) — a HIGH-severity denial-of-service.

`jsonparser` is a transitive indirect dependency here (pulled in via
`kcl-go/pkg/tools/gen`), but the project is what pins the old
version in `go.mod`, so bumping has to happen in this repo.

Bump to v1.6.1 (released 2026-07-30), the latest stable that
includes the v1.1.2 bounds-check fix plus a pile of subsequent
correctness and performance work. The build still succeeds (`go
build ./cmd/...`) and the unit tests under `./pkg/...` and
`./cmd/kclx/...` still pass; the pre-existing panic in
`TestModCmdWithSkipTlsVerify` (nil `*DepGraph` deref inside
`kpm@v0.12.9`) reproduces on `main` and is unrelated to this bump.

Refs #376

Pull Request Pull Request #379: fix(deps): bump github.com/buger/jsonparser to v1.6.1 (fixes #376)

Coverage Stats

247 of 892 relevant lines covered (27.69%)

0.3 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	33302539011.1	30 Aug 2026 08:53AM UTC	11	27.69	GitHub Action Run

kcl-lang / cli / 33302539011
28%
main: 31%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 33302539011

kcl-lang / cli / 33302539011 28% main: 31%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 33302539011

kcl-lang / cli / 33302539011
28%
main: 31%

README BADGES
x