1
73%
main: 73%

Ran 10 Nov 2026 11:15AM UTC

Files 1006

Run time 9s

Badge

Embed ▾

Committed 10 Nov 2026 11:05AM UTC coverage: 72.833% (+0.03%) from 72.8%

Job # 42804602634.1

Build Type

push

github

Committed by

web-flow

Commit Message

Restrict go-jose v3 imports with depguard (#7097)

The JWS guard from #7090 protects the two places where fosite parses
an untrusted JWT today, and an inventory test pins the routes and
fosite handlers that could add another. Neither catches new ToolHive
code that parses a JWT with go-jose v3 or fosite's token/jwt package
on an existing route, which would skip IsUnsafeJWS and reopen
GHSA-vvm8-gf78-28g4.

A depguard list now denies both packages in non-test code outside the
five files that already import them for types. A new importer fails
lint and has to join the list, so the change shows up in review. A
security rule covers what lint cannot see: new parsing inside a file
already on the list.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

94034 of 129109 relevant lines covered (72.83%)

858.25 hits per line

stacklok / toolhive / 42804602634 / 1
73%
main: 73%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 42804602634.1

stacklok / toolhive / 42804602634 / 1 73% main: 73%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 42804602634.1

stacklok / toolhive / 42804602634 / 1
73%
main: 73%

README BADGES
x