Advisories for Golang/Github.com/Netlify/Gotrue package

Impact What kind of vulnerability is it? Who is impacted? Under certain circumstances a valid user object would have been created with invalid provider metadata. This vulnerability affects everyone running an instance of GoTrue as a service. We advise you to update especially if you are using the provider metadata from the user object to secure other resources. Patches Has the problem been patched? What versions should users upgrade to? …

Impact The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider: goxmldsig - Signature Validation Bypass gosaml2 - Authentication Bypass Patches Patch available Please upgrade to v1.0.0 or commit hash a2b4dd6bc4ef7562d1df044098b303f564eefa90 Workarounds No known workarounds. For more information If you have any questions or comments about this advisory: Open an issue in gotrue Email us at security@netlify.com