Fix the vulnerable dependencies that block the release by Jordanh1996 · Pull Request #191 · jfrog/ide-plugins-common

Jordanh1996 · 2026-09-29T14:18:58Z

Background

The release workflow's audit gate blocks the next release on jackson 2.18.6, and on golang.org/x/mod v0.18.0 plus the runner's Go stdlib, both found through the gomod-absolutizer submodule.

Description

The Go scan runs go in the project directory with GOFLAGS=-modfile=<temp>/go.mod, so go reads and writes a temp copy of go.mod and go.sum while relative replace paths resolve as written. That replaces copying the project and rewriting its paths with the absolutizer, so the submodule (and the dead JFrog Pipelines release files) are removed. jackson goes to 2.21.7, the lowest version without known CVEs.

Tests

GoTreeBuilderTest passes on macOS, Windows and WSL, and now checks that the scanned project's go.mod and go.sum are left untouched. jf audit with the gate's exclusions reports 0 vulnerabilities.

All tests passed. If this feature is not already covered by the tests, I added new tests.

🤖 Generated with Claude Code

Rewrite relative replace paths with go mod edit instead of running the gomod-absolutizer, remove its submodule, and upgrade jackson to 2.21.7. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-09-29T14:19:07Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8fdfec6a-aae7-4c45-8f4f-5acc4e58dcbe

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

_{Comment @coderabbitai help to get the list of available commands.}

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Releases moved to the ecosystem-workflows GitHub Action (XRAY-137561). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

GoDriver runs commands through /bin/sh -c or cmd /c, so replace paths with spaces or shell characters broke the edit or ran as commands. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

GoDriver runs commands through /bin/sh -c or cmd /c. Values from the scanned go.mod are now referenced from the command instead of quoted into it, so no shell interprets them. On Windows, a replace directive with a double quote is skipped, since cmd cannot escape it inside quotes. The WSL conversion uses WslUtils, and absolute replace paths go through the same resolution as relative ones. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

go reads and writes a temp copy of go.mod (and go.sum) via GOFLAGS -modfile while running in the project directory, so relative replace paths resolve as they are and nothing from the go.mod reaches a shell. This removes GoScanWorkspaceCreator and its replace rewrite. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Set GOWORK=off, since workspace mode rejects -modfile, and start from go env GOFLAGS so values saved with go env -w are kept. The go version check runs without the scan flags. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

attiasas

The -modfile scan matches the goal: go runs in the project directory, relative replace paths still resolve from the module root, and writes go to a temp go.mod / go.sum that is deleted afterward. go version and go env GOFLAGS run before the scan flags, and GOWORK=off is set only on the scan driver. The gomod-absolutizer submodule and the old Pipelines release files are fully removed. Jackson 2.21.7 is the right pin.

All 18 unit-test jobs passed (Ubuntu, macOS, and Windows; Java 18/20/22; Go 1.23 and 1.24). Frogbot (scan-pull-request) was still pending.

Not blocking. Three small follow-ups inline.

attiasas · 2026-10-01T09:57:34Z

            DepTree dt = treeBuilder.buildTree();
            validateDependencyTreeResults(expected, dt);
+            assertEquals(Files.readString(projectDir.resolve("go.mod")), goMod);
+            assertFalse(Files.exists(projectDir.resolve("go.sum")));


This locks the no-go.sum case, which is enough to show -modfile is in effect: a tidy against the real module would have created go.sum.

testCreateDependencyTree2 is the checksum-mismatch fixture and still does not compare go.mod or go.sum before and after. modTidy passes ignoreErrors=true whenever Go is at least 1.16, so go mod tidy -e can succeed even when sums are wrong. A byte comparison on project2 would cover the case the absolutizer existed for.

attiasas · 2026-10-01T09:57:34Z

+            return flag;
        }
-        return goModAbsDir;
+        String quote = flag.contains("'") ? "\"" : "'";


Go 1.21 and later keep a quoted GOFLAGS path intact. Go 1.16 through 1.20 split GOFLAGS on whitespace and reject this form, so a temp directory under a path with a space (C:\Users\First Last\...) fails the scan. The failure happens before any write, so the project files stay intact.

CI only runs Go 1.23 and 1.24, and the GitHub Windows temp path has no space, so this branch never runs. A path that contains both ' and " is wrapped in one of those quotes and will not parse, with the same fail-closed behavior.

A unit test that builds GOFLAGS for a path containing a space, plus one scan whose temp directory contains a space, would cover it.

attiasas · 2026-10-01T09:57:34Z

+        if (runGoThroughWsl) {
+            // Windows environment variables reach go inside WSL only when WSLENV lists them.
+            String wslEnv = scanEnv.getOrDefault("WSLENV", System.getenv("WSLENV"));
+            scanEnv.put("WSLENV", StringUtils.isBlank(wslEnv) ? "GOFLAGS:GOWORK" : wslEnv + ":GOFLAGS:GOWORK");


This appends :GOFLAGS:GOWORK even when those names are already listed. A prior GOFLAGS/p then sits next to a second GOFLAGS. The value is already a Linux path (/mnt/c/...), so path translation should not rewrite it. Skipping names that are already present would make the intent obvious.

This path is not in CI. The workflow runs native Windows, not WSL.

…pe WSLENV Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Xray published XRAY-1097605 for commons-io 1.4, so the maven-example fixture now has four vulnerabilities and the exact count of three fails on every branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-10-01T10:20:28Z

🐸 JFrog Frogbot

Fix the vulnerable dependencies that block the release

c054a68

Rewrite relative replace paths with go mod edit instead of running the gomod-absolutizer, remove its submodule, and upgrade jackson to 2.21.7. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Jordanh1996 requested a deployment to frogbot September 29, 2026 14:19 — with GitHub Actions Waiting

Remove the leftover submodule steps

34f6248

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Jordanh1996 requested a deployment to frogbot September 29, 2026 14:34 — with GitHub Actions Waiting

Remove the JFrog Pipelines release definitions

a27b6f1

Releases moved to the ecosystem-workflows GitHub Action (XRAY-137561). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Jordanh1996 requested a deployment to frogbot September 29, 2026 14:36 — with GitHub Actions Waiting

Quote the go mod edit arguments for the command shell

2ea5148

GoDriver runs commands through /bin/sh -c or cmd /c, so replace paths with spaces or shell characters broke the edit or ran as commands. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Jordanh1996 requested a deployment to frogbot September 29, 2026 16:45 — with GitHub Actions Waiting

Document the go.mod replace rewrite and name its helpers plainly

18c88ed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Jordanh1996 requested a deployment to frogbot September 30, 2026 07:33 — with GitHub Actions Waiting

Jordanh1996 requested a deployment to frogbot September 30, 2026 14:05 — with GitHub Actions Waiting

Jordanh1996 requested a deployment to frogbot September 30, 2026 14:14 — with GitHub Actions Waiting

Jordanh1996 requested a deployment to frogbot September 30, 2026 16:08 — with GitHub Actions Waiting

attiasas added the improvement Automatically generated release notes label Oct 1, 2026

attiasas reviewed Oct 1, 2026

View reviewed changes

attiasas approved these changes Oct 1, 2026

View reviewed changes

Address review: pin project2 files, cover a quoted GOFLAGS path, dedu…

eb7e7a5

…pe WSLENV Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Jordanh1996 deployed to frogbot October 1, 2026 10:10 — with GitHub Actions Active

Jordanh1996 added the safe to test run tests label Oct 1, 2026

github-actions Bot removed the safe to test run tests label Oct 1, 2026

Check the Maven audit tests for the known CVEs instead of an exact count

850d8f9

Xray published XRAY-1097605 for commons-io 1.4, so the maven-example fixture now has four vulnerabilities and the exact count of three fails on every branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Jordanh1996 deployed to frogbot October 1, 2026 10:17 — with GitHub Actions Active

Jordanh1996 added the safe to test run tests label Oct 1, 2026

github-actions Bot removed the safe to test run tests label Oct 1, 2026

Jordanh1996 merged commit e047b80 into master Oct 1, 2026
39 checks passed

Jordanh1996 deleted the fix/XRAY-100231-replace-gomod-absolutizer branch October 1, 2026 10:43

Jordanh1996 mentioned this pull request Oct 1, 2026

Keep vulnerable transitive versions out of the dependency tree #192

Closed

1 task

Navigation Menu

Fix the vulnerable dependencies that block the release - #191

Fix the vulnerable dependencies that block the release#191
Jordanh1996 merged 10 commits into
masterfrom
fix/XRAY-100231-replace-gomod-absolutizer

Jordanh1996 commented Sep 29, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 29, 2026 •

edited

Loading

Uh oh!

attiasas left a comment

Uh oh!

attiasas Oct 1, 2026

Uh oh!

attiasas Oct 1, 2026

Uh oh!

attiasas Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Jordanh1996 commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Background

Description

Tests

Uh oh!

coderabbitai Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

attiasas left a comment

Choose a reason for hiding this comment

Uh oh!

attiasas Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

attiasas Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

attiasas Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Jordanh1996 commented Sep 29, 2026 •

edited

Loading

coderabbitai Bot commented Sep 29, 2026 •

edited

Loading