This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new eb076fee446 Limit Dependabot Go module updates to security advisories
only (#70914)
eb076fee446 is described below
commit eb076fee446bd158d9cc0b264b54c4ab170183aa
Author: Jason(Zhe-You) Liu <[email protected]>
AuthorDate: Tue Aug 4 06:17:23 2026 +0800
Limit Dependabot Go module updates to security advisories only (#70914)
The Go SDK's dependencies resolve directly to upstream repositories. Unlike
PyPI or npm, there is no central registry that pre-scans a release before it
is published, and whoever controls a module's namespace can cut a release at
any time. A dangling/hijacked namespace (as recently seen with slogcolor)
could therefore land a malicious version through a routine Dependabot bump
into contributors' dev environments and CI before anyone reviews it.
Disable automatic version-update PRs for the go-sdk gomod ecosystem on the
default branch (open-pull-requests-limit: 0) and keep only advisory-driven
security updates, which require a published GHSA advisory and cannot be
triggered by an upstream release self-declaring itself a security fix.
Routine
Go dependency bumps are now done manually when needed. Raise the gomod
cooldown
to 14 days so any release that is auto-considered on the v3-3-test branch
has a
longer window to be flagged before it is pulled in.
---
.github/dependabot.yml | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 59fbedc4737..bf1954690b1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -373,7 +373,9 @@ updates:
- package-ecosystem: "gomod"
cooldown:
- default-days: 4
+ # Longer than other ecosystems: distributed Go releases are not
pre-scanned by a
+ # central registry, so we give any malicious release more time to be
flagged.
+ default-days: 14
directory: "/go-sdk"
schedule:
interval: "weekly"
@@ -404,16 +406,21 @@ updates:
- "*"
applies-to: security-updates
+ # Go modules resolve straight to upstream repositories: there is no central
registry
+ # (unlike PyPI/npm) that pre-scans a release, and whoever controls a
module's namespace
+ # can publish a version at any time. To keep an unreviewed upstream Go
release from being
+ # auto-merged into our dev/CI chain, we do NOT raise automatic
version-update PRs here
+ # (`open-pull-requests-limit: 0`); routine Go bumps are done manually. We
still accept
+ # advisory-driven security updates, which require a published GHSA advisory
and so cannot
+ # be triggered by an upstream release self-declaring itself a "security" fix.
- package-ecosystem: "gomod"
cooldown:
- default-days: 4
+ default-days: 14
directory: "/go-sdk"
schedule:
interval: "weekly"
+ open-pull-requests-limit: 0
groups:
- go-sdk-dependency-updates:
- patterns:
- - "*"
go-sdk-security-updates:
patterns:
- "*"
