chore(deps): update module github.com/rs/cors to v1.11.0 [security] (release-1.13)

[phisco-renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/rs/cors	indirect	minor	v1.9.0 -> v1.11.0

GitHub Vulnerability Alerts

GHSA-mh55-gqvf-xfwm

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

---

Denial of service via malicious preflight requests in github.com/rs/cors

GHSA-mh55-gqvf-xfwm / GO-2024-2883

More information

Details

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Severity

Unknown

References

• https://github.com/rs/cors/pull/171
• https://github.com/rs/cors/issues/170

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Denial of service via malicious preflight requests in github.com/rs/cors

GHSA-mh55-gqvf-xfwm / GO-2024-2883

More information

Details

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Severity

Moderate

References

• https://github.com/rs/cors/issues/170
• https://github.com/rs/cors/pull/171
• https://github.com/rs/cors/commit/4c32059b2756926619f6bf70281b91be7b5dddb2
• https://github.com/rs/cors

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rs/cors (github.com/rs/cors)

v1.11.0

Compare Source

v1.10.1

Compare Source

v1.10.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[phisco-renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.mod

Command failed: install-tool golang $(grep -oP "^toolchain go\K.+" go.mod)

File name: go.mod

Command failed: make generate
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
	panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0xa07b8f]

goroutine 155 [running]:
go/types.(*Checker).handleBailout(0xc001dc8a00, 0xc000335d40)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/check.go:367 +0x88
panic({0xbbe580?, 0x12a74b0?})
	/opt/containerbase/tools/golang/1.22.5/src/runtime/panic.go:770 +0x132
go/types.(*StdSizes).Sizeof(0x0, {0xdb81d8, 0x12afc80})
	/opt/containerbase/tools/golang/1.22.5/src/go/types/sizes.go:228 +0x30f
go/types.(*Config).sizeof(...)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/sizes.go:333
go/types.representableConst.func1({0xdb81d8?, 0x12afc80?})
	/opt/containerbase/tools/golang/1.22.5/src/go/types/const.go:76 +0x9e
go/types.representableConst({0xdbe530, 0x127ac80}, 0xc001dc8a00, 0x12afc80, 0x0)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/const.go:92 +0x192
go/types.(*Checker).arrayLength(0xc001dc8a00, {0xdbc7d8, 0xc001dc5700?})
	/opt/containerbase/tools/golang/1.22.5/src/go/types/typexpr.go:510 +0x2d3
go/types.(*Checker).typInternal(0xc001dc8a00, {0xdbadf8, 0xc001dcc5d0}, 0x0)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/typexpr.go:299 +0x49d
go/types.(*Checker).definedType(0xc001dc8a00, {0xdbadf8, 0xc001dcc5d0}, 0xc000335328?)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/typexpr.go:180 +0x37
go/types.(*Checker).varType(0xc001dc8a00, {0xdbadf8, 0xc001dcc5d0})
	/opt/containerbase/tools/golang/1.22.5/src/go/types/typexpr.go:145 +0x25
go/types.(*Checker).structType(0xc001dc8a00, 0xc001ddde30, 0xc001ddde30?)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/struct.go:113 +0x19f
go/types.(*Checker).typInternal(0xc001dc8a00, {0xdbad68, 0xc001db7cb0}, 0xc001de2550)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/typexpr.go:316 +0x1345
go/types.(*Checker).definedType(0xc001dc8a00, {0xdbad68, 0xc001db7cb0}, 0xc8786d?)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/typexpr.go:180 +0x37
go/types.(*Checker).typeDecl(0xc001dc8a00, 0xc001de2550, 0xc001dd0480, 0x0)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/decl.go:615 +0x44d
go/types.(*Checker).objDecl(0xc001dc8a00, {0xdc3a80, 0xc001de2550}, 0x0)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/decl.go:197 +0xa7f
go/types.(*Checker).packageObjects(0xc001dc8a00)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/resolver.go:681 +0x425
go/types.(*Checker).checkFiles(0xc001dc8a00, {0xc001d821f8, 0x3, 0x3})
	/opt/containerbase/tools/golang/1.22.5/src/go/types/check.go:408 +0x1a5
go/types.(*Checker).Files(...)
	/opt/containerbase/tools/golang/1.22.5/src/go/types/check.go:372
sigs.k8s.io/controller-tools/pkg/loader.(*loader).typeCheck(0xc00027d440, 0xc0001474a0)
	/home/ubuntu/go/pkg/mod/sigs.k8s.io/controller-tools@v0.12.1/pkg/loader/loader.go:286 +0x36a
sigs.k8s.io/controller-tools/pkg/loader.(*Package).NeedTypesInfo(0xc0001474a0)
	/home/ubuntu/go/pkg/mod/sigs.k8s.io/controller-tools@v0.12.1/pkg/loader/loader.go:99 +0x39
sigs.k8s.io/controller-tools/pkg/loader.(*TypeChecker).check(0xc000541560, 0xc0001474a0)
	/home/ubuntu/go/pkg/mod/sigs.k8s.io/controller-tools@v0.12.1/pkg/loader/refs.go:268 +0x2b7
sigs.k8s.io/controller-tools/pkg/loader.(*TypeChecker).check.func1(0x3c?)
	/home/ubuntu/go/pkg/mod/sigs.k8s.io/controller-tools@v0.12.1/pkg/loader/refs.go:262 +0x53
created by sigs.k8s.io/controller-tools/pkg/loader.(*TypeChecker).check in goroutine 93
	/home/ubuntu/go/pkg/mod/sigs.k8s.io/controller-tools@v0.12.1/pkg/loader/refs.go:260 +0x1c5
exit status 2
apis/generate.go:45: running "go": exit status 1
make[1]: *** [build/makelib/golang.mk:240: go.generate] Error 1
make: *** [build/makelib/common.mk:434: generate] Error 2