chore(deps): update module github.com/buger/jsonparser to v1.1.2 [security] by renovate[bot] · Pull Request #80 · futo-org/backups

renovate · 2026-10-23T16:48:35Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/buger/jsonparser	`v1.1.1` → `v1.1.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

github.com/buger/jsonparser has a denial of service vulnerability

CVE-2026-32285 / GHSA-6g7g-w4f8-9c9x

More information

Details

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

buger/jsonparser (github.com/buger/jsonparser)

`v1.1.2`

Compare Source

What's Changed

Updated travis to build for 1.13 to 1.15 by @janreggie in #225
- eliminate 2 allocations in EachKey() by @Villenny in #223
fix issue #150 (in deleting case) by @daria-kay in #226
fixing the oss-fuzz issue by @daria-kay in #227
Fix parseInt overflow check false negative by @carsonip in #231
Added bespoke error for null cases by @jonomacd in #228
Fuzzing: Add CIFuzz by @AdamKorcz in #239
Added latest versions of go to tests by @moredure in #244
fix EachKey pIdxFlags allocation by @unxcepted in #241
fix: prevent panic on negative slice index in Delete with malformed JSON (GO-2026-4514) by @dbarrosop in #276

New Contributors

@janreggie made their first contribution in #225
@Villenny made their first contribution in #223
@daria-kay made their first contribution in #226
@carsonip made their first contribution in #231
@jonomacd made their first contribution in #228
@moredure made their first contribution in #244
@unxcepted made their first contribution in #241
@dbarrosop made their first contribution in #276

Full Changelog: buger/jsonparser@v1.1.1...v1.1.2

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

futo-kritika · 2026-10-23T16:49:01Z

Confidence Score: 3/5

[Low risk] The reported P1 stands: go.sum in packages/columbo still holds only the v1.1.1 checksums, so builds in read-only module mode fail on a missing checksum until the v1.1.2 entries are committed. The risk rests on a patch bump of an indirect, standalone dependency that has no direct use in the application and fixes a Delete panic.

Not approved: confidence 3/5 is below the threshold of 4

Findings

packages/columbo/go.mod:26 Commit the checksums for jsonparser v1.1.2 · correctness

Summary

Updates Columbo's indirect jsonparser dependency to v1.1.2.

The patch update changes the indirect requirement in packages/columbo/go.mod. The upstream release notes describe a malformed-JSON Delete panic fix alongside integer parsing, null-error and EachKey changes. Columbo's Dockerfile resolves dependencies during image builds and compiles the application from the copied module sources.

Review context · 1/6 commands

Commands run: rg

_{Reviews (2) · Last reviewed commit: "chore(deps): update module github.com/bu..." · openai/gpt-6.1-sol · $0.10}

futo-kritika

kritika: confidence 5/5 with low risk at 7921258.

…urity]

renovate · 2026-10-26T18:00:29Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: packages/columbo/go.sum

[18:00:12.059] INFO (1592): Installing tool golang@1.27.3...
[18:00:15.367] ERROR (1592): failed to check url
    url: "https://github.com/containerbase/golang-prebuild/releases/download/1.27.3/golang-1.27.3-x86_64.tar.xz.sha512"
    err: {
      "type": "HTTPError",
      "message": "Request failed with status code 504 (Gateway Time-out): HEAD https://github.com/containerbase/golang-prebuild/releases/download/1.27.3/golang-1.27.3-x86_64.tar.xz.sha512",
      "stack":
          HTTPError: Request failed with status code 504 (Gateway Time-out): HEAD https://github.com/containerbase/golang-prebuild/releases/download/1.27.3/golang-1.27.3-x86_64.tar.xz.sha512
              at file:///snapshot/dist/app/main-DBQlCuFq.js:37296:28
              at Request.<anonymous> (file:///snapshot/dist/app/main-DBQlCuFq.js:37302:7)
              at Request.wrapper (node:events:639:12)
              at Request.emit (node:events:526:24)
              at Request.emit (node:domain:489:12)
              at Request._onResponseBase (file:///snapshot/dist/app/main-DBQlCuFq.js:36550:22)
              at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
              at async Request._onResponse (file:///snapshot/dist/app/main-DBQlCuFq.js:36587:4)
      "name": "HTTPError",
      "code": "ERR_NON_2XX_3XX_RESPONSE",
      "timings": {
        "start": 1793037615360,
        "socket": 1793037615360,
        "lookup": 1793037615360,
        "connect": 1793037615360,
        "secureConnect": 1793037615360,
        "upload": 1793037615361,
        "response": 1793037615364,
        "end": 1793037615365,
        "phases": {
          "wait": 0,
          "dns": 1,
          "tcp": 4,
          "tls": 7,
          "request": 1,
          "firstByte": 3,
          "download": 1,
          "total": 5
        }
      },
      "options": {
        "agent": {},
        "decompress": true,
        "timeout": {},
        "prefixUrl": "",
        "ignoreInvalidCookies": false,
        "context": {},
        "hooks": {
          "init": [],
          "beforeRequest": [],
          "beforeError": [],
          "beforeRedirect": [],
          "beforeRetry": [],
          "beforeCache": [],
          "afterResponse": []
        },
        "followRedirect": true,
        "maxRedirects": 10,
        "throwHttpErrors": true,
        "username": "",
        "password": "",
        "http2": false,
        "allowGetBody": false,
        "allowAbsoluteUrls": true,
        "copyPipedHeaders": false,
        "headers": {
          "user-agent": "containerbase/14.52.9 node/24.22.1 (https://github.com/containerbase)",
          "accept-encoding": "gzip, deflate, br, zstd"
        },
        "methodRewriting": false,
        "retry": {
          "limit": 2,
          "methods": [
            "GET",
            "PUT",
            "HEAD",
            "DELETE",
            "OPTIONS",
            "TRACE"
          ],
          "statusCodes": [
            408,
            413,
            429,
            500,
            502,
            503,
            504,
            521,
            522,
            524
          ],
          "errorCodes": [
            "ETIMEDOUT",
            "ECONNRESET",
            "EADDRINUSE",
            "ECONNREFUSED",
            "EPIPE",
            "ENOTFOUND",
            "ENETUNREACH",
            "EAI_AGAIN"
          ],
          "backoffLimit": null,
          "noise": 100,
          "enforceRetryRules": true
        },
        "method": "HEAD",
        "cacheOptions": {},
        "https": {},
        "resolveBodyOnly": false,
        "isStream": false,
        "responseType": "text",
        "url": "https://github.com/containerbase/golang-prebuild/releases/download/1.27.3/golang-1.27.3-x86_64.tar.xz.sha512",
        "pagination": {
          "countLimit": null,
          "backoff": 0,
          "requestLimit": 10000,
          "stackAllItems": false
        },
        "setHost": true,
        "enableUnixSockets": false,
        "strictContentLength": true
      }
    }
[18:00:15.428] ERROR (1592): Request failed with status code 504 (Gateway Time-out): HEAD https://github.com/containerbase/golang-prebuild/releases/download/1.27.3/golang-1.27.3-x86_64.tar.xz.sha512
[18:00:15.429] FATAL (1592): Install tool golang failed in 3.3s.

futo-kritika · 2026-10-26T18:01:13Z

 	github.com/ProtonMail/go-crypto v1.1.6 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
-	github.com/buger/jsonparser v1.1.1 // indirect
+	github.com/buger/jsonparser v1.1.2 // indirect


Commit the checksums for jsonparser v1.1.2 · correctness

When building from a clean checkout, packages/columbo/go.sum still contains only the v1.1.1 checksums (lines 17–18), so Go's default read-only module mode rejects the newly selected dependency with a missing-checksum error. The Dockerfile's initial go mod download does not resolve this: its subsequent COPY packages/columbo/ ./ restores the stale committed go.sum before go run and go build. Commit the v1.1.2 checksums with this bump.

Suggested fix

Run cd packages/columbo && go mod download github.com/buger/jsonparser and commit the resulting go.sum entries for v1.1.2.

Prompt for a coding agent

Update packages/columbo/go.sum alongside the jsonparser version change at packages/columbo/go.mod:26. Run go mod download github.com/buger/jsonparser from packages/columbo and commit the generated v1.1.2 module and go.mod checksums, so builds do not depend on modifying the checksum file first.

kritika: confidence 3/5 is below the threshold of 4 at 4fca5d2.

renovate Bot added changelog:skip dependencies renovate labels Oct 23, 2026

futo-kritika Bot previously approved these changes Oct 23, 2026

View reviewed changes

chore(deps): update module github.com/buger/jsonparser to v1.1.2 [sec…

4fca5d2

…urity]

renovate Bot force-pushed the renovate/go-github.com-buger-jsonparser-vulnerability branch from 7921258 to 4fca5d2 Compare October 26, 2026 18:00

futo-kritika Bot reviewed Oct 26, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore(deps): update module github.com/buger/jsonparser to v1.1.2 [security] - #80

chore(deps): update module github.com/buger/jsonparser to v1.1.2 [security]#80
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-github.com-buger-jsonparser-vulnerability

renovate Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

futo-kritika Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

futo-kritika Bot left a comment

Uh oh!

renovate Bot commented Oct 26, 2026

Uh oh!

futo-kritika Bot Oct 26, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github.com/buger/jsonparser has a denial of service vulnerability

Details

Severity

References

Release Notes

v1.1.2

What's Changed

New Contributors

Configuration

Uh oh!

futo-kritika Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 3/5

Findings

Summary

Uh oh!

futo-kritika Bot left a comment

Choose a reason for hiding this comment

Uh oh!

renovate Bot commented Oct 26, 2026

⚠️ Artifact update problem

File name: packages/columbo/go.sum

Uh oh!

futo-kritika Bot Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 23, 2026 •

edited

Loading

`v1.1.2`

futo-kritika Bot commented Oct 23, 2026 •

edited

Loading