Skip to content

chore(deps): bump github.com/russellhaering/goxmldsig from 1.3.0 to 1.6.0 in /apps/login/acceptance/idp/saml - #4

Open
dependabot[bot] wants to merge 2 commits into
productionfrom
dependabot/go_modules/apps/login/acceptance/idp/saml/github.com/russellhaering/goxmldsig-1.6.0
Open

dependabot[bot] wants to merge 2 commits into
productionfrom
dependabot/go_modules/apps/login/acceptance/idp/saml/github.com/russellhaering/goxmldsig-1.6.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •

Copy link
Copy Markdown

Bumps github.com/russellhaering/goxmldsig from 1.3.0 to 1.6.0.

Release notes

Sourced from github.com/russellhaering/goxmldsig's releases.

v1.6.0

What's Changed

  • Security: Fix possible signature validation bypass caused by loop variable capture in validateSignature (GHSA-479m-364c-43vc)
  • Bump minimum Go version to 1.23
  • Bump github.com/beevik/etree to v1.6.0
  • Add fuzz tests for XML signature validation and canonicalization

Full Changelog: russellhaering/goxmldsig@v1.5.0...v1.6.0

v1.5.0

What's Changed

Full Changelog: russellhaering/goxmldsig@v1.4.0...v1.5.0

v1.4.0

What's Changed

New Contributors

Full Changelog: russellhaering/goxmldsig@v1.3.0...v1.4.0

Commits
  • 878c8c6 Apply go fix ./...
  • db3d1e3 Fix loop variable capture bug in validateSignature
  • 4f576b8 Bump dependencies
  • 79c29ee Rename FuzzValidate to FuzzValidateXML to avoid name collision
  • ac7bf74 Add fuzz tests for XML signature validation and canonicalization
  • a5805df Bump github/codeql-action from 2.13.4 to 3.28.17 (#155)
  • 7dac9ec Update GitHub Workflow
  • 1bf54ca Bump dependencies
  • e1c8a5b Refactor to help eliminate potential vulnerabilities:
  • 2ac5490 Refactor .verifyCertificate to obtain the certificate from an identifier from...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Dependabot: dependencies go Dependabot: go labels Aug 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/apps/login/acceptance/idp/saml/github.com/russellhaering/goxmldsig-1.6.0 branch from e5c1697 to 6e4ce25 Compare September 4, 2026 11:14
Bumps [github.com/russellhaering/goxmldsig](https://github.com/russellhaering/goxmldsig) from 1.3.0 to 1.6.0.
- [Release notes](https://github.com/russellhaering/goxmldsig/releases)
- [Commits](russellhaering/goxmldsig@v1.3.0...v1.6.0)

---
updated-dependencies:
- dependency-name: github.com/russellhaering/goxmldsig
  dependency-version: 1.6.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/apps/login/acceptance/idp/saml/github.com/russellhaering/goxmldsig-1.6.0 branch from 6e4ce25 to f9635c9 Compare September 21, 2026 12:46
@github-actions
github-actions Bot force-pushed the production branch 2 times, most recently from 6538a5d to 697e487 Compare September 24, 2026 11:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependabot: dependencies go Dependabot: go

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants