Repository: go-kratos/kratos
Pull request #3642 (2025-04-22 06:41:49)

deps:deps CVE-2025-30204 about golang-jwt
<!--
🎉 Thanks for sending a pull request to Kratos! Here are some tips for you:

1. If this is your first time contributing to Kratos, please read our contribution guide: https://go-kratos.dev/en/docs/community/contribution/
2. Ensure you have added or ran the appropriate tests and lint for your PR, please use `make lint` and `make test` before filing your PR, use `make clean` to tidy your go mod.
3. If the PR is unfinished, you may need to mark it as a WIP(Work In Progress) PR or Draft PR
4. Please use a semantic commits format title, such as `<type>[optional scope]: <description>`, see: https://go-kratos.dev/docs/community/contribution#type
5. at the same time, please note that similar work should be submitted in one PR as far as possible to reduce the workload of reviewers. Do not split a work into multiple PR unless it should.
-->

<!--deps
🎉 感谢您向 Kratos 发送 PR！以下是一些提示：
如果这是你第一次为 Kratos 贡献，请阅读我们的贡献指南：https://go-kratos.dev/en/docs/community/contribution/
2、确保您已经为您的 PR 添加或运行了适当的测试和lint，请在提交PR之前使用“make lint”和“make test”，使用“make clean”整理您的 go.mod。
3、如果 PR 未完成，您可能需要将其标记为 WIP（Work In Progress）PR 或 Draft PR
4、请使用语义提交格式标题，如“<类型>[可选范围]：<说明>`，请参阅：https://go-kratos.dev/docs/community/contribution#type
5. 同时请注意，同类的工作请尽量在一个PR中提交，以减轻 review 者的工作负担，不要把一项工作拆分成很多个PR，除非它应该这样做。
-->


#### Description (what this PR does / why we need it):
<!--
* The description should include the motivation for this PR or contrast this with previous behavior
-->
Ref:https://nvd.nist.gov/vuln/detail/CVE-2025-30204

#### Which issue(s) this PR fixes (resolves / be part of):
<!--
* Automatically closes linked issue when PR is merged.
* If your PR is not fully resolved the issue, please use `part of #<issue number>` instead.

Usage: `fixes/resolves #<issue number>`, or `fixes/resolves (paste link of issue)`.
-->


#### Other special notes for the reviewers:
<!--
* Some things that need extra attention for the reviewers
* Some additional notes, TODO list, etc.
-->



Patch:
diff --git a/README_zh.md b/README_zh.md
index 230f52f0..c060ff19 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -23,7 +23,8 @@ Kratos 一套轻量级 Go 微服务框架，包含大量微服务相关功能及
 
 ## Goals
 
-我们致力于提供完整的微服务研发体验，整合相关框架及工具后，微服务治理相关部分可对整体业务开发周期无感，从而更加聚焦于业务交付。对每位开发者而言，整套 Kratos 框架也是不错的学习仓库，可以了解和参考到微服务方面的技术积累和经验。
+我们致力于提供完整、全面的微服务研发体验，通过整合相关框架和工具，微服务治理部分能够无缝融入整个业务开发周期，使开发者更加专注于业务交付。
+对每位开发者而言，Kratos 是非常不错的学习仓库，可以了解和参考微服务领域的技术积累和经验。
 
 ### Principles
 
@@ -35,9 +36,10 @@ Kratos 一套轻量级 Go 微服务框架，包含大量微服务相关功能及
 * 高性能：性能高，但不特定为了性能做 hack 优化，引入 unsafe ；
 * 扩展性：良好的接口设计，来扩展实现，或者通过新增基础库目录来扩展功能；
 * 容错性：为失败设计，大量引入对 SRE 的理解，鲁棒性高；
-* 工具链：包含大量工具链，比如 cache 代码生成，lint 工具等等；
+* 工具链：包含大量工具链，比如 cache 代码生成，lint 工具等等。
 
 ## Features
+
 * [APIs](https://go-kratos.dev/docs/component/api) ：协议通信以 HTTP/gRPC 为基础，通过 Protobuf 进行定义；
 * [Errors](https://go-kratos.dev/docs/component/errors/) ：通过 Protobuf 的 Enum 作为错误码定义，以及工具生成判定接口；
 * [Metadata](https://go-kratos.dev/docs/component/metadata) ：在协议通信 HTTP/gRPC 中，通过 Middleware 规范化服务元信息传递；
@@ -48,22 +50,28 @@ Kratos 一套轻量级 Go 微服务框架，包含大量微服务相关功能及
 * [Encoding](https://go-kratos.dev/docs/component/encoding) ：支持 Accept 和 Content-Type 进行自动选择内容编码；
 * [Transport](https://go-kratos.dev/docs/component/transport/overview) ：通用的 [HTTP](https://go-kratos.dev/docs/component/transport/http) /[gRPC](https://go-kratos.dev/docs/component/transport/grpc) 传输层，实现统一的 [Middleware](https://go-kratos.dev/docs/component/middleware/overview) 插件支持；
 * [Registry](https://go-kratos.dev/docs/component/registry) ：实现统一注册中心接口，可插件化对接各种注册中心；
-* [Validation](https://go-kratos.dev/docs/component/middleware/validate): 通过Protobuf统一定义校验规则，并同时适用于HTTP/gRPC服务.
-* [SwaggerAPI](https://go-kratos.dev/docs/guide/openapi): 通过集成第三方[Swagger插件](https://github.com/go-kratos/swagger-api) 能够自动生成Swagger API json并启动一个内置的Swagger UI服务.
+* [Validation](https://go-kratos.dev/docs/component/middleware/validate): 通过 Protobuf 统一定义校验规则，并同时适用于 HTTP/gRPC 服务；
+* [SwaggerAPI](https://go-kratos.dev/docs/guide/openapi): 通过集成第三方 [Swagger 插件](https://github.com/go-kratos/swagger-api) 能够自动生成 Swagger API 文档并启动内置的 Swagger UI服 务。
 
 ## Getting Started
+
 ### Required
+
 - [go](https://golang.org/dl/)
 - [protoc](https://github.com/protocolbuffers/protobuf)
 - [protoc-gen-go](https://github.com/protocolbuffers/protobuf-go)
 
 ### Installing
+
 ##### go install 安装：
+
 ```
 go install github.com/go-kratos/kratos/cmd/kratos/v2@latest
 kratos upgrade
 ```
+
 ##### 源码编译安装：
+
 ```
 git clone https://github.com/go-kratos/kratos
 cd kratos
@@ -71,6 +79,7 @@ make install
 ```
 
 ### Create a service
+
 ```
 # 创建项目模板
 kratos new helloworld
@@ -79,14 +88,14 @@ cd helloworld
 # 拉取项目依赖
 go mod download
 
-# 生成proto模板
+# 生成 proto 模板
 kratos proto add api/helloworld/helloworld.proto
-# 生成proto源码
+# 生成 proto 源码
 kratos proto client api/helloworld/helloworld.proto
-# 生成server模板
+# 生成 server 模板
 kratos proto server api/helloworld/helloworld.proto -t internal/service
 
-# 生成所有proto源码、wire等等
+# 生成所有 proto 源码、wire 等等
 go generate ./...
 
 # 运行程序
@@ -94,6 +103,7 @@ kratos run
 ```
 
 ### Kratos Boot
+
 ```
 import "github.com/go-kratos/kratos/v2"
 import "github.com/go-kratos/kratos/v2/transport/grpc"
@@ -117,16 +127,20 @@ app.Run()
 * [Service Layout](https://github.com/go-kratos/kratos-layout)
 
 ## Community
+
 * [Wechat Group](https://github.com/go-kratos/kratos/issues/682)
 * [Discord Group](https://discord.gg/BWzJsUJ)
 * Website:  [go-kratos.dev](https://go-kratos.dev)
 * QQ Group: 716486124
 
 ## WeChat Official Account
+
 ![kratos](docs/images/wechat.png)
 
 ## Conventional commits
+
 提交信息的结构应该如下所示:
+
 ```text
 <type>[optional scope]: <description>
 
@@ -146,4 +160,5 @@ app.Run()
 ![kratos](docs/images/alipay.png)
 
 ## License
+
 Kratos is MIT licensed. See the [LICENSE](./LICENSE) file for details.
diff --git a/go.mod b/go.mod
index ba669874..c63a5526 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/fsnotify/fsnotify v1.6.0
 	github.com/go-kratos/aegis v0.2.0
 	github.com/go-playground/form/v4 v4.2.0
-	github.com/golang-jwt/jwt/v5 v5.1.0
+	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/google/uuid v1.4.0
 	github.com/gorilla/mux v1.8.1
 	go.opentelemetry.io/otel v1.24.0
diff --git a/go.sum b/go.sum
index 00afca12..402c0a22 100644
--- a/go.sum
+++ b/go.sum
@@ -27,8 +27,8 @@ github.com/go-playground/assert/v2 v2.0.1 h1:MsBgLAaY856+nPRTKrp3/OZK38U/wa0CcBY
 github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/form/v4 v4.2.0 h1:N1wh+Goz61e6w66vo8vJkQt+uwZSoLz50kZPJWR8eic=
 github.com/go-playground/form/v4 v4.2.0/go.mod h1:q1a2BY+AQUUzhl6xA/6hBetay6dEIhMHjgvJiGo6K7U=
-github.com/golang-jwt/jwt/v5 v5.1.0 h1:UGKbA/IPjtS6zLcdB7i5TyACMgSbOTiR8qzXgw8HWQU=
-github.com/golang-jwt/jwt/v5 v5.1.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
diff --git a/transport/http/transport.go b/transport/http/transport.go
index 0400ea83..0cbf4f49 100644
--- a/transport/http/transport.go
+++ b/transport/http/transport.go
@@ -14,6 +14,7 @@ type Transporter interface {
 	transport.Transporter
 	Request() *http.Request
 	PathTemplate() string
+	Response() http.ResponseWriter
 }
 
 // Transport is an HTTP transport.
@@ -52,6 +53,11 @@ func (tr *Transport) RequestHeader() transport.Header {
 	return tr.reqHeader
 }
 
+// Response returns the HTTP response.
+func (tr *Transport) Response() http.ResponseWriter {
+	return tr.response
+}
+
 // ReplyHeader returns the reply header.
 func (tr *Transport) ReplyHeader() transport.Header {
 	return tr.replyHeader


Test patch:
diff --git a/middleware/tracing/tracing_test.go b/middleware/tracing/tracing_test.go
index 4070daf7..e57b1f12 100644
--- a/middleware/tracing/tracing_test.go
+++ b/middleware/tracing/tracing_test.go
@@ -3,6 +3,7 @@ package tracing
 import (
 	"context"
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"reflect"
 	"testing"
@@ -71,6 +72,9 @@ func (tr *mockTransport) Request() *http.Request {
 	return tr.request
 }
 func (tr *mockTransport) PathTemplate() string { return "" }
+func (tr *mockTransport) Response() http.ResponseWriter {
+	return httptest.NewRecorder()
+}
 
 func TestTracer(t *testing.T) {
 	carrier := headerCarrier{}
diff --git a/transport/http/transport_test.go b/transport/http/transport_test.go
index 01095c7e..6d52cac3 100644
--- a/transport/http/transport_test.go
+++ b/transport/http/transport_test.go
@@ -50,6 +50,14 @@ func TestTransport_RequestHeader(t *testing.T) {
 	}
 }
 
+func TestTransport_Response(t *testing.T) {
+	v := http.ResponseWriter(nil)
+	o := &Transport{response: v}
+	if !reflect.DeepEqual(v, o.Response()) {
+		t.Errorf("expect %v, got %v", v, o.Request())
+	}
+}
+
 func TestTransport_ReplyHeader(t *testing.T) {
 	v := headerCarrier{}
 	v.Set("a", "1")