main · last commit
18 hours ago ·
7bghjra2
sr-ht-ecore-3sa Bump gqlparser to v2.5.36 and gqlgen to v0.17.94 in go.mod
Lined Up
bd update sr-ht-ecore-3sa --claim
bd close sr-ht-ecore-3sa
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-08-17T20:35:28Z |
| Updated | 2026-08-17T20:35:28Z |
What is wrong: sr-ht-ecore/go.mod pins github.com/vektah/gqlparser/v2 v2.5.8 and github.com/99designs/gqlgen v0.17.36, below the GO-2024-2920 security floor (a DoS in gqlparser's parseDirectives, fixed in v2.5.14). gqlgen v0.17.36 also pins golang.org/x/tools v0.9.3, which does not compile under the current toolchain, breaking 'go generate ./graph' in downstream consumers (observed in sourcehut-specs). Why it matters: sr-ht-ecore is a shared library, so its floor becomes every consumer's floor. sourcehut-specs, sourcehut-compare and sourcehut-tokens all inherit this pin transitively via sr-ht-ecore/sr-ht-core. This must land before those consumers can be bumped (sr-ht-core needs the same bump first). Correct variant, already in use by: sourcehut-artifacts, sourcehut-bench, sourcehut-coverage, sourcehut-curator, sourcehut-dolt, sourcehut-federation, sr-ht-api and thistle, all on gqlparser v2.5.36 + gqlgen v0.17.94. Fix: go get github.com/vektah/gqlparser/v2@v2.5.36 github.com/99designs/gqlgen@v0.17.94 in sr-ht-ecore/go.mod. Confidence: verified (version strings read directly out of all nine services' go.mod plus sr-ht-core and sr-ht-ecore; split is exactly 5/5). Audit: D06 (cross-repo audit, 2026-08-17)
No outgoing dependencies.
Nothing depends on this issue.
| id | sr-ht-ecore-3sa |
| content_hash | 215f333df6ff16c8b5689438a7ddeb225dd529efd8e3f1b66d3f3de31a9bc980 |
| title | Bump gqlparser to v2.5.36 and gqlgen to v0.17.94 in go.mod |
| description | What is wrong: sr-ht-ecore/go.mod pins github.com/vektah/gqlparser/v2 v2.5.8 and github.com/99designs/gqlgen v0.17.36, below the GO-2024-2920 security floor (a DoS in gqlparser's parseDirectives, fixed in v2.5.14). gqlgen v0.17.36 also pins golang.org/x/tools v0.9.3, which does not compile under the current toolchain, breaking 'go generate ./graph' in downstream consumers (observed in sourcehut-specs). Why it matters: sr-ht-ecore is a shared library, so its floor becomes every consumer's floor. sourcehut-specs, sourcehut-compare and sourcehut-tokens all inherit this pin transitively via sr-ht-ecore/sr-ht-core. This must land before those consumers can be bumped (sr-ht-core needs the same bump first). Correct variant, already in use by: sourcehut-artifacts, sourcehut-bench, sourcehut-coverage, sourcehut-curator, sourcehut-dolt, sourcehut-federation, sr-ht-api and thistle, all on gqlparser v2.5.36 + gqlgen v0.17.94. Fix: go get github.com/vektah/gqlparser/v2@v2.5.36 github.com/99designs/gqlgen@v0.17.94 in sr-ht-ecore/go.mod. Confidence: verified (version strings read directly out of all nine services' go.mod plus sr-ht-core and sr-ht-ecore; split is exactly 5/5). Audit: D06 (cross-repo audit, 2026-08-17) |
| design | |
| acceptance_criteria | |
| notes | |
| status | open |
| priority | 0 |
| issue_type | bug |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-08-17T20:35:28Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-17T20:35:28Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| id | 01a0116f-b233-76c2-9e30-c79058e8fc19 |
| issue_id | sr-ht-ecore-3sa |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-08-17T23:35:27Z |
No comments.