mattermost-10.3/10.3.1-r1: cve remediation

[octo-sts]

mattermost-10.3/10.3.1-r1: fix GHSA-q8fg-cp3q-5jwm

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/mattermost-10.3.advisories.yaml

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

Based on the error output, I'll provide a specific analysis and solution:

• Detected Error: "Failed to running update. Error: bumping the main module is not allowed 'github.com/mattermost/mattermost/server/v8'"

• Error Category: Configuration/Build

• Failure Point: The go/bump step in the pipeline attempting to update dependencies

• Root Cause Analysis: The go/bump action is trying to modify the main module, which is not allowed. The current configuration is attempting to update the core module itself rather than just its dependencies.

• Suggested Fix: Modify the go/bump step to only update the dependencies without touching the main module. Update the YAML as follows:

  - uses: go/bump
    with:
      deps: golang.org/x/[email protected] golang.org/x/[email protected]
      replaces: github.com/mholt/archiver/v3=github.com/anchore/archiver/[email protected]
      modroot: ./server
      tidy: false

• Explanation: Remove the github.com/mattermost/mattermost/server/v8 from the deps list since it's the main module. The gobump tool is designed to update dependencies, not the main module itself.

• Additional Notes:

• Keep the replaces directive as it's still valid for dependency replacement
• The tidy: false setting is correctly maintained due to the referenced issue
• This change maintains the security updates while following proper module update patterns

• References:

• Unable to build FOSS release mattermost/mattermost#26221 (for tidy: false context)
• https://golang.org/ref/mod#go-mod-tidy (Go modules documentation)

This fix should allow the build to proceed while maintaining the necessary dependency updates and replacements.

[mamccorm]

false positive raised:

• https://github.com/wolfi-dev/advisories/blob/cb42ecb601e1ed5df642471271d71221f0978e45/mattermost-10.3.advisories.yaml#L79