deps(gobgp): bump osrg/gobgp from v3.37.0 to v4.8.0

Author: Rissochek

.cspell.json

@@ -130,6 +130,7 @@
     "OpenSSF",
     "openvswitch",
     "OSPF",
+    "osrg",
     "osv",
     "OVN",
     "OVS",

CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Bump optional GoBGP integration from `github.com/osrg/gobgp/v3 v3.37.0` to
+  `github.com/osrg/gobgp/v4 v4.8.0`, including interop and integration example
+  container images. Remove the `GO-2026-4736` vulnerability allowlist entry
+  after upgrading to a fixed upstream release.
+
 ### Removed
 
 - `.archive/` directory removed from the repository. Sprint planning

CHANGELOG.ru.md

@@ -7,6 +7,13 @@
 
 ## [Не выпущено]
 
+### Изменено
+
+- Обновлена опциональная интеграция GoBGP с `github.com/osrg/gobgp/v3 v3.37.0`
+  до `github.com/osrg/gobgp/v4 v4.8.0`, включая container images в interop и
+  integration examples. Запись vulnerability allowlist для `GO-2026-4736`
+  удалена после перехода на исправленный upstream release.
+
 ### Удалено
 
 - Каталог `.archive/` удалён из репозитория. Sprint planning records,

SECURITY.md

@@ -62,25 +62,6 @@ network. Security-relevant areas include:
   for loopback or trusted management networks, and plaintext non-loopback
   endpoints emit a startup warning
 
-## Known Dependency Advisory
-
-### GO-2026-4736 — GoBGP NEXT_HOP denial of service
-
-`github.com/osrg/gobgp/v3 v3.37.0` is affected by
-[GO-2026-4736](https://pkg.go.dev/vuln/GO-2026-4736), a denial-of-service
-advisory in GoBGP's handling of the BGP NEXT_HOP path attribute. As of
-2026-04-22, the advisory does not list a fixed version.
-
-GoBFD uses GoBGP only for the optional GoBGP integration path. Until an upstream
-fix is available, operators should keep the GoBGP gRPC endpoint bound to
-localhost or another trusted management network. For remote GoBGP API endpoints,
-enable `gobgp.tls.enabled` and configure `gobgp.tls.ca_file` / `server_name`.
-Do not expose plaintext GoBGP gRPC to untrusted peers.
-
-CI allowlists only `GO-2026-4736` in `scripts/vuln-audit.go`. Any additional
-advisory reported by `govulncheck` or `osv-scanner` fails the vulnerability
-audit. Remove the allowlist entry after upgrading GoBGP to a fixed release.
-
 ## Accepted Protocol Exceptions
 
 ### MD5 and SHA1 in BFD authentication

deployments/integrations/bgp-fast-failover/compose.yml

@@ -34,7 +34,7 @@ services:
   # === GoBGP (BGP daemon, shared netns with gobfd) ===
 
   gobgp:
-    image: docker.io/jauderho/gobgp:v3.33.0
+    image: docker.io/jauderho/gobgp:v4.8.0
     container_name: gobgp-bgp-failover
     user: "0:0"
     cap_add:

deployments/integrations/exabgp-anycast/compose.yml

@@ -17,7 +17,7 @@ services:
   # === GoBGP (route receiver) at 172.24.0.10 ===
 
   gobgp:
-    image: docker.io/jauderho/gobgp:v3.33.0
+    image: docker.io/jauderho/gobgp:v4.8.0
     container_name: gobgp-anycast
     user: "0:0"
     cap_add:

deployments/integrations/kubernetes/manifests/daemonset.yml

@@ -74,7 +74,7 @@ spec:
               memory: 64Mi
 
         - name: gobgp
-          image: docker.io/jauderho/gobgp:v3.33.0
+          image: docker.io/jauderho/gobgp:v4.8.0
           args: ["-f", "/etc/gobgp/gobgp.toml", "-l", "info"]
           ports:
             - name: bgp

docs/en/15-security.md

@@ -57,12 +57,6 @@ GoBFD can connect to GoBGP through `gobgp.addr`. Plaintext mode is acceptable
 only for loopback or trusted management networks. Enable `gobgp.tls.enabled`
 for remote or non-loopback GoBGP endpoints.
 
-The current GoBGP module has allowlisted advisory `GO-2026-4736`. The
-mitigation is to keep the GoBGP API on localhost or a trusted management
-network until upstream ships a fixed release. The allowlist entry in
-`scripts/vuln-audit.go` has an owner, expiry, reason, and mitigation; expiry
-turns the vulnerability gate into a failure.
-
 ## Secrets
 
 RFC 5880 auth secrets may be supplied through YAML or gRPC `AddSession`.

docs/en/reference/dependency-risk.md

@@ -31,33 +31,29 @@ The `reeflective/console` library provides the interactive shell for `gobfdctl`.
 
 ---
 
-## osrg/gobgp/v3 — High Risk
+## osrg/gobgp/v4 — Medium Risk
 
 | Field | Value |
 |-------|-------|
-| **Module** | `github.com/osrg/gobgp/v3 v3.37.0` |
+| **Module** | `github.com/osrg/gobgp/v4 v4.8.0` |
 | **Used in** | `internal/gobgp/` — optional GoBGP integration |
-| **Known advisory** | `GO-2026-4736` / `CVE-2026-30405` / `GHSA-4p9m-8gc4-rw2h` |
-| **Risk level** | High |
-| **Allowlist owner** | `maintainers` |
-| **Review deadline** | `2026-07-31` |
+| **Known advisory** | `GO-2026-4736` fixed in `v4.4.0` and later |
+| **Risk level** | Medium |
 
 ### Description
 
-GoBGP is affected by a denial-of-service advisory in BGP NEXT_HOP path
-attribute handling. As of 2026-05-02, the Go vulnerability database does not
-list a fixed version.
+GoBGP provides the optional BGP control-plane coupling for BFD session state
+changes. GoBFD pins `v4.8.0`, which includes the upstream fix for
+`GO-2026-4736` / `CVE-2026-30405`.
 
 ### Mitigation
 
-1. **Bounded exposure**: The GoBGP path is optional and should connect only to a
-   GoBGP gRPC endpoint on localhost or a trusted management network.
-2. **Controlled CI allowlist**: `scripts/vuln-audit.go` allowlists only
-   `GO-2026-4736`; the entry includes owner, expiry, reason, and mitigation.
-   Any additional `govulncheck` or OSV finding, and any expired allowlist
-   entry, fails CI.
-3. **Upgrade trigger**: Remove the allowlist entry after upstream publishes a
-   fixed GoBGP release and `go mod tidy` moves the module to that version.
+1. **Bounded exposure**: Keep the GoBGP gRPC endpoint on localhost or a trusted
+   management network unless TLS is enabled.
+2. **TLS for remote endpoints**: Enable `gobgp.tls.enabled` and configure
+   `gobgp.tls.ca_file` / `gobgp.tls.server_name` for non-loopback deployments.
+3. **Strict vulnerability gate**: `scripts/vuln-audit.go` does not allowlist
+   GoBGP advisories; any new `govulncheck` or OSV finding fails CI.
 
 ---
 

docs/ru/15-security.md

@@ -57,12 +57,6 @@ GoBFD подключается к GoBGP через `gobgp.addr`. Plaintext до
 loopback или доверенной management-сети. Для удалённых или non-loopback
 endpoints включайте `gobgp.tls.enabled`.
 
-Текущий модуль GoBGP имеет allowlisted advisory `GO-2026-4736`. Митигация:
-держать GoBGP API на localhost или в доверенной management-сети, пока upstream
-не выпустит исправленную версию. Запись allowlist в `scripts/vuln-audit.go`
-содержит owner, expiry, reason и mitigation; после expiry vulnerability gate
-падает.
-
 ## Секреты
 
 RFC 5880 auth secrets можно передавать через YAML или gRPC `AddSession`.