Skip to content

Update module github.com/in-toto/in-toto-golang to v0.11.0 [SECURITY] (release-v0.7) - #3295

Open
renovate[bot] wants to merge 1 commit into
release-v0.7from
renovate/release-v0.7-go-github.com-in-toto-in-toto-golang-vulnerability
Open

Update module github.com/in-toto/in-toto-golang to v0.11.0 [SECURITY] (release-v0.7)#3295
renovate[bot] wants to merge 1 commit into
release-v0.7from
renovate/release-v0.7-go-github.com-in-toto-in-toto-golang-vulnerability

Conversation

@renovate

@renovate renovate Bot commented May 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/in-toto/in-toto-golang v0.10.0 → v0.11.0 age adoption passing confidence

in-toto-golang and in-toto-python have inconsistent negation behavior

GHSA-pmwq-pjrm-6p5r

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

in-toto-golang and in-toto-python both support glob patterns in artifact rules to indicate the artifacts that a rule applies to. Both support negations in character classes to indicate what should not be matched, but they used different operators to indicate the negation. in-toto-python uses ! while in-toto-golang used ^. A layout authored with the expectations of one implementation can therefore exhibit different behavior in the other implementation.

This impacts users in a specific set of circumstances where two different implementations are used to verify the same layout + attestation bundle at different stages of the same pipeline. As a rule of thumb, we advise using a single implementation across all aspects of a pipeline, from layout creation to pipeline execution and verification to prevent this class of bugs.

Patches

Has the problem been patched? What versions should users upgrade to?

in-toto-golang has been updated to use ! instead of ^ to indicate negation. See https://github.com/in-toto/in-toto-golang/pull/462. This is part of v0.11.0.

Severity

  • CVSS Score: 4.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

in-toto/in-toto-golang (github.com/in-toto/in-toto-golang)

v0.11.0

Compare Source

What's Changed

Full Changelog: in-toto/in-toto-golang@v0.10.0...v0.11.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov

codecov Bot commented May 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag Coverage Δ
generative 69.55% <ø> (ø)
integration 69.55% <ø> (ø)
unit 69.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@renovate
renovate Bot force-pushed the renovate/release-v0.7-go-github.com-in-toto-in-toto-golang-vulnerability branch from d5ae10d to ad0421f Compare May 18, 2026 10:46
@renovate
renovate Bot force-pushed the renovate/release-v0.7-go-github.com-in-toto-in-toto-golang-vulnerability branch from ad0421f to 4a5c019 Compare May 27, 2026 08:26
@renovate
renovate Bot force-pushed the renovate/release-v0.7-go-github.com-in-toto-in-toto-golang-vulnerability branch from 4a5c019 to 55d09fd Compare July 12, 2026 11:00
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 11:01 AM UTC · Completed 11:09 AM UTC
Commit: 87c4a29 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Looks good to me

Previous run

Looks good to me

Previous run (2)

Looks good to me

Previous run (3)

Looks good to me

Labels: Go dependency version bump by Renovate — adding standard dependency and language labels consistent with repo conventions.

Previous run (4)

Looks good to me

Previous run (5)

Review

Verdict: Approve

This PR bumps github.com/in-toto/in-toto-golang from v0.10.0 to v0.11.0 to address GHSA-pmwq-pjrm-6p5r (CVSS 4.1, Medium — inconsistent negation behavior in artifact rule glob patterns).

Analysis

Scope & intent: Mechanical dependency version bump generated by Renovate targeting the release-v0.7 branch. Changes are limited to go.mod and go.sum in both the root and acceptance/ modules (4 files, +6/−6). No application code is modified.

Behavior change impact: The v0.11.0 release changes the glob pattern negation operator in character classes from ^ to ! for artifact rule matching. This codebase uses in-toto-golang exclusively for data types — in_toto.Statement, in_toto.Subject, SLSA provenance structs (v0.2, v1) — and does not invoke any layout verification, artifact rule matching, or glob pattern functions. The behavioral change has no impact on this codebase.

Security: No secrets, injection patterns, or permission changes in the diff. The update correctly addresses the stated advisory.

Follow-up

  • tools/go.mod still references github.com/in-toto/in-toto-golang v0.10.0 as an indirect dependency. While indirect and in a tooling module, consider updating it for consistency and to clear the CVE from the full dependency tree.
Reviewed dimensions
Dimension Result
Correctness ✅ No issues — affected code paths not used
Security ✅ Advisory addressed, no exposure in diff
Intent & coherence ✅ Mechanical change, implicit authorization
Style & conventions ✅ No style surface area
Documentation ✅ No docs impact
Cross-repo contracts ✅ No exported API changes

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added the ready-for-merge All reviewers approved — ready to merge label Jul 12, 2026
@renovate
renovate Bot force-pushed the renovate/release-v0.7-go-github.com-in-toto-in-toto-golang-vulnerability branch from 55d09fd to 5d612c4 Compare July 21, 2026 01:12
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:13 AM UTC · Completed 1:20 AM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/release-v0.7-go-github.com-in-toto-in-toto-golang-vulnerability branch from 5d612c4 to f8c4ef6 Compare July 30, 2026 22:15
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 10:16 PM UTC · Completed 10:23 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 30, 2026
@dheerajodha

dheerajodha commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

/retest

@renovate
renovate Bot force-pushed the renovate/release-v0.7-go-github.com-in-toto-in-toto-golang-vulnerability branch from f8c4ef6 to bf7a71f Compare August 4, 2026 12:05
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:06 PM UTC · Completed 12:12 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/release-v0.7-go-github.com-in-toto-in-toto-golang-vulnerability branch from bf7a71f to fa04b27 Compare August 11, 2026 16:59
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:00 PM UTC · Completed 5:06 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/release-v0.7-go-github.com-in-toto-in-toto-golang-vulnerability branch from fa04b27 to aaa4e89 Compare August 14, 2026 16:30
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 4:31 PM UTC · Completed 4:37 PM UTC

Commit: 87c4a29 · View workflow run →

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] approved these changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code ready-for-merge All reviewers approved — ready to merge release-v0.7 renovate size: XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dheerajodha