Repository: redpanda-data/connect (language: go)

Issue:
High CVE-2025-30204 in github.com/golang-jwt/jwt/v5
Impacted version: 5.2.1
Fixed version: 5.2.2


Discussion / hints:

Fix patch:
diff --git a/go.mod b/go.mod
index eecf252333..8f36b886fe 100644
--- a/go.mod
+++ b/go.mod
@@ -74,8 +74,7 @@ require (
 	github.com/go-sql-driver/mysql v1.8.1
 	github.com/gocql/gocql v1.6.0
 	github.com/gofrs/uuid/v5 v5.3.1
-	github.com/golang-jwt/jwt v3.2.2+incompatible
-	github.com/golang-jwt/jwt/v5 v5.2.1
+	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/googleapis/go-sql-spanner v1.8.0
 	github.com/gosimple/slug v1.14.0
 	github.com/hamba/avro/v2 v2.28.0
diff --git a/go.sum b/go.sum
index a63f2bb19b..656f983580 100644
--- a/go.sum
+++ b/go.sum
@@ -1163,8 +1163,8 @@ github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keL
 github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
-github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
diff --git a/internal/impl/jaeger/tracer_jaeger.go b/internal/impl/jaeger/tracer_jaeger.go
index cc63e9bd2c..5aefeef783 100644
--- a/internal/impl/jaeger/tracer_jaeger.go
+++ b/internal/impl/jaeger/tracer_jaeger.go
@@ -22,12 +22,15 @@ import (
 	"time"
 
 	"go.opentelemetry.io/otel/attribute"
-	"go.opentelemetry.io/otel/exporters/jaeger" //nolint:staticcheck
+
 	"go.opentelemetry.io/otel/sdk/resource"
 	tracesdk "go.opentelemetry.io/otel/sdk/trace"
 	semconv "go.opentelemetry.io/otel/semconv/v1.7.0"
 	"go.opentelemetry.io/otel/trace"
 
+	//nolint:staticcheck
+	"go.opentelemetry.io/otel/exporters/jaeger"
+
 	"github.com/redpanda-data/benthos/v4/public/service"
 )
 
diff --git a/internal/impl/protobuf/common.go b/internal/impl/protobuf/common.go
index 85978a9a1e..2ae5da80cd 100644
--- a/internal/impl/protobuf/common.go
+++ b/internal/impl/protobuf/common.go
@@ -17,10 +17,11 @@ package protobuf
 import (
 	"fmt"
 
-	//nolint:staticcheck // Ignore SA1019 "github.com/jhump/protoreflect/desc/protoparse" is deprecated warning
-	"github.com/jhump/protoreflect/desc/protoparse"
 	"google.golang.org/protobuf/reflect/protoregistry"
 	"google.golang.org/protobuf/types/dynamicpb"
+
+	//nolint:staticcheck // Ignore SA1019 "github.com/jhump/protoreflect/desc/protoparse" is deprecated warning
+	"github.com/jhump/protoreflect/desc/protoparse"
 )
 
 // RegistriesFromMap attempts to parse a map of filenames (relative to import
diff --git a/internal/impl/snowflake/streaming/rest.go b/internal/impl/snowflake/streaming/rest.go
index fd5f51145a..b18e26663c 100644
--- a/internal/impl/snowflake/streaming/rest.go
+++ b/internal/impl/snowflake/streaming/rest.go
@@ -26,7 +26,7 @@ import (
 	"time"
 
 	"github.com/cenkalti/backoff/v4"
-	"github.com/golang-jwt/jwt"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/google/uuid"
 	"github.com/redpanda-data/benthos/v4/public/service"
 


Test patch:
diff --git a/internal/impl/jaeger/tracer_jaeger_test.go b/internal/impl/jaeger/tracer_jaeger_test.go
index b6cd98b4b1..c6d06b40a5 100644
--- a/internal/impl/jaeger/tracer_jaeger_test.go
+++ b/internal/impl/jaeger/tracer_jaeger_test.go
@@ -21,10 +21,12 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel/attribute"
-	"go.opentelemetry.io/otel/exporters/jaeger" //nolint:staticcheck
 	tracesdk "go.opentelemetry.io/otel/sdk/trace"
 	"go.opentelemetry.io/otel/sdk/trace/tracetest"
 	semconv "go.opentelemetry.io/otel/semconv/v1.7.0"
+
+	//nolint:staticcheck
+	"go.opentelemetry.io/otel/exporters/jaeger"
 )
 
 func TestGetAgentOps(t *testing.T) {