40733430083
65%

Ran 28 Oct 2026 05:23PM UTC

Jobs 1

Files 359

Run time 1min

Badge

Embed ▾

Committed 28 Oct 2026 05:12PM UTC coverage: 64.675%. Remained the same

Build # 40733430083

Build Type

push

github

Committed by

web-flow

Commit Message

build(deps): bump go-jose/go-jose/v4 to v4.1.6 (CVE-2026-116587) (#7012)

Bump go-jose/v4 to v4.1.6 for CVE-2026-116587

go-jose before v4.1.6 parses RSA parameters from JWKs without size
bounds, letting crafted keys cause excessive CPU use during key
validation on Go 1.24+. Minder fetches JWKS from OIDC issuers, so
the indirect dependency is reachable at runtime.

This also unblocks the Trivy security scan, which has been failing
on every PR since the advisory was published.

Signed-off-by: intelligent-ears <karyasdas2005@gmail.com>

Coverage Stats

22908 of 35420 relevant lines covered (64.68%)

57.67 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	40733430083.1	28 Oct 2026 05:23PM UTC	359	64.68	GitHub Action Run

mindersec / minder / 40733430083
65%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 40733430083

mindersec / minder / 40733430083 65%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 40733430083

mindersec / minder / 40733430083
65%

README BADGES
x