feat(oci/gokapi)!: Update v1.9.6 ➼ v2.2.4

[tinfoild]

This PR contains the following updates:

Package	Update	Change
docker.io/f0rc3/gokapi	major	v1.9.6 → v2.2.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	6101f36
Status:	🚫  Build failed.

View logs

[tinfoild]

kube/helmrelease/out00

--- HelmRelease: gokapi/gokapi Deployment: gokapi/gokapi

+++ HelmRelease: gokapi/gokapi Deployment: gokapi/gokapi

@@ -25,13 +25,13 @@

       serviceAccountName: default
       automountServiceAccountToken: true
       dnsPolicy: ClusterFirst
       enableServiceLinks: true
       containers:
       - name: gokapi
-        image: docker.io/f0rc3/gokapi:v1.9.6@sha256:ae9094a0ead891eef80499a072e680734bcb34892242f0e232223c65eb4c3af8
+        image: docker.io/f0rc3/gokapi:v2.2.4@sha256:43cd93b9e1f02d760923f67f6e74e1c4d4a9cccb9b08fa42ad60770333f231eb
         imagePullPolicy: null
         env:
         - name: GOKAPI_MAX_MEMORY_UPLOAD
           value: '128'
         - name: GOKAPI_PORT
           value: '53842'

[tinfoild]

kube/kustomization/out00

--- kube/deploy/apps/gokapi/app Kustomization: flux-system/gokapi-app HelmRelease: gokapi/gokapi

+++ kube/deploy/apps/gokapi/app Kustomization: flux-system/gokapi-app HelmRelease: gokapi/gokapi

@@ -45,13 +45,13 @@

       strategy: RollingUpdate
     env:
       GOKAPI_MAX_MEMORY_UPLOAD: '128'
       GOKAPI_PORT: 53842
     image:
       repository: docker.io/f0rc3/gokapi
-      tag: v1.9.6@sha256:ae9094a0ead891eef80499a072e680734bcb34892242f0e232223c65eb4c3af8
+      tag: v2.2.4@sha256:43cd93b9e1f02d760923f67f6e74e1c4d4a9cccb9b08fa42ad60770333f231eb
     ingress:
       main:
         enabled: true
         hosts:
         - host: gokapi
           paths:

[tinfoild]

kube/kustomization/out00

--- kube/deploy/apps/gokapi/app Kustomization: flux-system/gokapi-app HelmRelease: gokapi/gokapi

+++ kube/deploy/apps/gokapi/app Kustomization: flux-system/gokapi-app HelmRelease: gokapi/gokapi

@@ -45,13 +45,13 @@

       strategy: RollingUpdate
     env:
       GOKAPI_MAX_MEMORY_UPLOAD: '128'
       GOKAPI_PORT: 53842
     image:
       repository: docker.io/f0rc3/gokapi
-      tag: v1.9.6@sha256:ae9094a0ead891eef80499a072e680734bcb34892242f0e232223c65eb4c3af8
+      tag: v2.0.1@sha256:2278851d0cf3401af03745756b551d02f1cacde52a56f69988d3ec0f78fccb3a
     ingress:
       main:
         enabled: true
         hosts:
         - host: gokapi
           paths:

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 01:46 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #2611 — feat(oci/gokapi)!: Update v1.9.6 ➼ v2.2.4
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 10

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	1
MEDIUM / MODERATE	9
LOW	0
UNKNOWN / NEEDS VERIFICATION	0
Total	10

---

Results

Package: docker.io/f0rc3/gokapi (github.com/forceu/gokapi)

• Ecosystem: Go / Docker (OCI)
• Old version: v1.9.6 — VULNERABLE (10 CVEs)
• New version: v2.2.4 — CLEAN

Vulnerabilities in version v1.9.6

1. CVE-2026-28683 / GHSA-3c22-5j5m-4jq7 — Severity: HIGH (CVSS 8.7)

   • Description: Stored XSS in SVG Hotlinks by authenticated user.
   • Affected versions: < 2.2.3
   • Fixed in: 2.2.3
   • Sources: NVD, OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-28683 | GHSA-3c22-5j5m-4jq7
   • Status: ✅ Fixed in newer versions

2. CVE-2026-28682 / GHSA-c36c-7pc2-f2ph — Severity: MEDIUM (CVSS 6.4)

   • Description: Data Leak in Upload Status Stream exposing file IDs to other users.
   • Affected versions: < 2.2.3
   • Fixed in: 2.2.3
   • Sources: NVD, OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-28682 | GHSA-c36c-7pc2-f2ph
   • Status: ✅ Fixed in newer versions

3. CVE-2026-30955 / GHSA-qwc6-vc2v-2ggj — Severity: MEDIUM (CVSS 6.5)

   • Description: DoS via unbounded request body in E2E Metadata Parser endpoint.
   • Affected versions: <= 2.2.3
   • Fixed in: 2.2.4
   • Sources: NVD, OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-30955 | GHSA-qwc6-vc2v-2ggj
   • Status: ✅ Fixed in newer versions

4. CVE-2025-48494 / GHSA-95rc-wc32-gm53 — Severity: MEDIUM (CVSS 5.4)

   • Description: Stored XSS via uploading file with JavaScript in filename.
   • Affected versions: >= 1.0.1, <= 1.9.6
   • Fixed in: 2.0.0
   • Sources: NVD, OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2025-48494 | GHSA-95rc-wc32-gm53
   • Status: ✅ Fixed in newer versions

5. CVE-2025-48495 / GHSA-4xg4-54hm-9j77 — Severity: MEDIUM (CVSS 5.4)

   • Description: Stored XSS in friendly name for API keys.
   • Affected versions: >= 1.0.1, <= 1.9.6
   • Fixed in: 2.0.0
   • Sources: NVD, OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2025-48495 | GHSA-4xg4-54hm-9j77
   • Status: ✅ Fixed in newer versions

6. CVE-2026-29061 / GHSA-q658-hfpg-35qc — Severity: MEDIUM (CVSS 5.4)

   • Description: Privilege escalation via retained API-key permissions after demotion.
   • Affected versions: < 2.2.3
   • Fixed in: 2.2.3
   • Sources: NVD, OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-29061 | GHSA-q658-hfpg-35qc
   • Status: ✅ Fixed in newer versions

7. CVE-2026-29060 / GHSA-m2hx-wjxc-9fp4 — Severity: MEDIUM (CVSS 5.0)

   • Description: Privilege escalation allowing creation of API keys with request permissions.
   • Affected versions: < 2.2.3
   • Fixed in: 2.2.3
   • Sources: NVD, OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-29060 | GHSA-m2hx-wjxc-9fp4
   • Status: ✅ Fixed in newer versions

8. CVE-2026-29084 / GHSA-hcff-qv74-7hr4 — Severity: MEDIUM (CVSS 4.6)

   • Description: CSRF in Login Endpoint accepting credential-bearing requests without CSRF tokens.
   • Affected versions: < 2.2.3
   • Fixed in: 2.2.3
   • Sources: NVD, OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-29084 | GHSA-hcff-qv74-7hr4
   • Status: ✅ Fixed in newer versions

9. CVE-2026-30961 / GHSA-45vh-rpc8-hxpp — Severity: MEDIUM (CVSS 4.3)

   • Description: File Request MaxSize limit bypassed via multi-chunk upload.
   • Affected versions: <= 2.2.3
   • Fixed in: 2.2.4
   • Sources: NVD, OSV.dev, GHSA
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-30961 | GHSA-45vh-rpc8-hxpp
   • Status: ✅ Fixed in newer versions

10. CVE-2026-30943 / GHSA-j6jp-78w8-34x6 — Severity: MEDIUM (CVSS 4.1)

• Description: Privilege escalation in File Replace — user can delete another user's file via API.
• Affected versions: <= 2.2.3
• Fixed in: 2.2.4
• Sources: NVD, OSV.dev, GHSA
• Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-30943 | GHSA-j6jp-78w8-34x6
• Status: ✅ Fixed in newer versions

Vulnerabilities in version v2.2.4

No known vulnerabilities found. All 10 identified CVEs are fixed in v2.0.0, v2.2.3, or v2.2.4.

Changelog Security Highlights (v1.9.6 → v2.2.4)

• v2.0.0 — Fixed two MEDIUM XSS vulnerabilities (GHSA-95rc-wc32-gm53, GHSA-4xg4-54hm-9j77); introduced permission system
• v2.2.3 — Fixed one HIGH (stored XSS) and four MEDIUM vulns (data leak, privilege escalation, CSRF, retention)
• v2.2.4 — Fixed three MEDIUM vulns (DoS, privilege escalation, max-size bypass); updated to Go 1.26.1

---

Recommendations

• MERGE PRIORITY: HIGH — The old version (v1.9.6) has 1 HIGH-severity and 9 MEDIUM-severity vulnerabilities remediated by this major-version update. The new version (v2.2.4) introduces no new known vulnerabilities.
• ⚠️ Major version upgrade (v1 → v2): This is a breaking change with multi-user support and permission system. Review the v2.0.0 migration notes before merging.
• Merge this PR promptly to remediate active security exposure.

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.