Harden supply chain: inline jsonpointer, migrate yaml, pin actions

Your Name · claude · Your Name · commit c9880b9d749d · 2026-02-22T17:02:39.000-08:00
- Replace go-openapi/jsonpointer with inlined RFC 6901 functions,
  eliminating jsonpointer and swag/jsonname dependencies.
- Migrate gopkg.in/yaml.v3 (archived) to go.yaml.in/yaml/v3 v3.0.4.
- Pin GitHub Actions to full SHA (checkout v6.0.2, setup-go v6.2.0)
  and remove dead step.
- Replace curl of wasm_exec.js with cp from GOROOT.
- Update Dockerfile to golang:1.24 and validate it in make target.
- Add SECURITY.md, dependabot.yml, and security docs to CLAUDE.md
  and README.md.

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "gomod"
+    directory: "/v2"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
@@ -14,13 +14,10 @@ jobs:
   Test:
     runs-on: ubuntu-latest
     steps:
-    - name: Hello
-      run: echo I am first
-    
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
       with:
         go-version: '1.24'
 
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -31,6 +31,15 @@ It is focused on a human-readable diff format but has the ability to read and pr
 - `/lib` - Deprecated v1 library (read-only)
 - `main.go` - Deprecated v1 commandline (read-only)
 
+## Supply Chain Security
+
+- Dependencies MUST be minimal. Do not add new dependencies without justification.
+- GitHub Actions MUST be pinned to full commit SHA with version comment.
+- When bumping Go toolchain: update `GOTOOLCHAIN` in Makefile, `toolchain` in both go.mod
+  files, and `FROM golang:` in Dockerfile. `make validate-toolchain` checks all of these.
+- `wasm_exec.js` is copied from GOROOT at build time — no manual update needed.
+- Run `govulncheck ./...` periodically to check for stdlib and dependency vulns.
+
 ## Advice
 
 - Try and avoid creating temporary files and instead rely on modifying existing unit tests for debugging.
diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.23 AS build
+FROM golang:1.24 AS build
 RUN mkdir -p /go/src/github.com/josephburnett/jd
 WORKDIR /go/src/github.com/josephburnett/jd
 COPY . .
diff --git a/Makefile b/Makefile
@@ -20,6 +20,15 @@ validate-toolchain :
 		echo "  Please update GOTOOLCHAIN in Makefile to match go.mod"; \
 		exit 1; \
 	fi; \
+	GOMOD_VERSION=$$(grep '^go ' go.mod | awk '{print $$2}' | cut -d. -f1,2); \
+	DOCKER_VERSION=$$(grep '^FROM golang:' Dockerfile | head -1 | sed 's/FROM golang:\([0-9.]*\).*/\1/'); \
+	if [ "$$GOMOD_VERSION" != "$$DOCKER_VERSION" ]; then \
+		echo "Error: Dockerfile Go version does not match go.mod:"; \
+		echo "  Dockerfile: golang:$$DOCKER_VERSION"; \
+		echo "  go.mod go directive: $$GOMOD_VERSION"; \
+		echo "  Please update FROM golang: in Dockerfile to match go.mod"; \
+		exit 1; \
+	fi; \
 	echo "✓ Toolchain validation passed: $$ROOT_TOOLCHAIN"
 
 .PHONY : build
@@ -73,7 +82,7 @@ pack-web : build-web validate-toolchain
 
 .PHONY : build-web
 build-web : validate-toolchain
-	cd v2 ; curl -fsSL https://raw.githubusercontent.com/golang/go/go1.23.12/misc/wasm/wasm_exec.js -o internal/web/assets/wasm_exec.js
+	cp "$$(go env GOROOT)/lib/wasm/wasm_exec.js" v2/internal/web/assets/wasm_exec.js
 	cd v2 ; GOOS=js GOARCH=wasm go build -o internal/web/assets/jd.wasm ./internal/web/ui
 
 .PHONY : serve
diff --git a/README.md b/README.md
@@ -565,3 +565,10 @@ kubectl get deployment example -oyaml | jd -yaml -opts='[
 kubectl patch deployment example2 --type json --patch "$(jd -t jd2patch cpu-patch)"
 ```
 
+## Security
+
+To report a vulnerability, see [SECURITY.md](SECURITY.md).
+
+This project uses minimal dependencies, pinned GitHub Actions, and automated
+dependency updates via Dependabot.
+
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| v2.x    | Yes       |
+| v1.x    | No (deprecated) |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it by emailing
+**josephburnett@fastmail.com**.
+
+- You can expect an acknowledgment within 7 days (best effort).
+- Please include steps to reproduce and any relevant details.
+- We ask for coordinated disclosure — please do not publish details
+  before a fix is available.
+
+## Credit
+
+Contributors who report valid vulnerabilities will be credited in the
+release notes (unless they prefer to remain anonymous).
diff --git a/go.mod b/go.mod
@@ -13,8 +13,8 @@ require (
 require (
 	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
 	github.com/kr/text v0.2.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
 replace github.com/josephburnett/jd/v2 => ./v2
diff --git a/go.sum b/go.sum
@@ -17,6 +17,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/v2/go.mod b/v2/go.mod
@@ -5,13 +5,12 @@ go 1.24.0
 toolchain go1.24.13
 
 require (
-	github.com/go-openapi/jsonpointer v0.22.4
 	github.com/stretchr/testify v1.11.1
-	gopkg.in/yaml.v3 v3.0.1
+	go.yaml.in/yaml/v3 v3.0.4
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/v2/go.sum b/v2/go.sum
@@ -1,15 +1,11 @@
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/go-openapi/jsonpointer v0.22.4 h1:dZtK82WlNpVLDW2jlA1YCiVJFVqkED1MegOUy9kR5T4=
-github.com/go-openapi/jsonpointer v0.22.4/go.mod h1:elX9+UgznpFhgBuaMQ7iu4lvvX1nvNsesQ3oxmYTw80=
-github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
-github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
-github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
-github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/v2/node_read.go b/v2/node_read.go
@@ -5,7 +5,7 @@ import (
 	"os"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 // ReadJsonFile reads a file as JSON and constructs a JsonNode.
diff --git a/v2/node_write.go b/v2/node_write.go
@@ -3,7 +3,7 @@ package jd
 import (
 	"encoding/json"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func renderJson(i interface{}) string {
diff --git a/v2/pointer.go b/v2/pointer.go
@@ -4,16 +4,13 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
-
-	"github.com/go-openapi/jsonpointer"
 )
 
 func readPointer(s string) (Path, error) {
-	pointer, err := jsonpointer.New(s)
+	tokens, err := jsonPointerParse(s)
 	if err != nil {
 		return nil, err
 	}
-	tokens := pointer.DecodedTokens()
 	path := make(jsonArray, len(tokens))
 	for i, t := range tokens {
 		var element JsonNode
@@ -44,7 +41,7 @@ func writePointer(path []JsonNode) (string, error) {
 			if int(e) == -1 {
 				b.WriteString("-")
 			} else {
-				b.WriteString(jsonpointer.Escape(strconv.Itoa(int(e))))
+				b.WriteString(jsonPointerEscape(strconv.Itoa(int(e))))
 			}
 		case jsonString:
 			if _, err := strconv.Atoi(string(e)); err == nil {
@@ -53,7 +50,7 @@ func writePointer(path []JsonNode) (string, error) {
 			if string(e) == "-" {
 				return "", fmt.Errorf("JSON Pointer does not support object key '-'")
 			}
-			s := jsonpointer.Escape(string(e))
+			s := jsonPointerEscape(string(e))
 			b.WriteString(s)
 		case jsonObject:
 			return "", fmt.Errorf("JSON Pointer does not support set-based paths. Use jd format instead of patch")
@@ -65,3 +62,28 @@ func writePointer(path []JsonNode) (string, error) {
 	}
 	return b.String(), nil
 }
+
+var jsonPointerUnescaper = strings.NewReplacer("~1", "/", "~0", "~")
+var jsonPointerEscaper = strings.NewReplacer("~", "~0", "/", "~1")
+
+// jsonPointerParse validates and parses a JSON Pointer (RFC 6901) string
+// into decoded reference tokens.
+func jsonPointerParse(s string) ([]string, error) {
+	if s == "" {
+		return nil, nil
+	}
+	if s[0] != '/' {
+		return nil, fmt.Errorf("non-empty JSON pointer must start with '/'")
+	}
+	tokens := strings.Split(s[1:], "/")
+	for i, t := range tokens {
+		tokens[i] = jsonPointerUnescaper.Replace(t)
+	}
+	return tokens, nil
+}
+
+// jsonPointerEscape escapes a reference token per RFC 6901:
+// '~' → '~0', '/' → '~1'.
+func jsonPointerEscape(token string) string {
+	return jsonPointerEscaper.Replace(token)
+}

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM golang:1.23 AS build`
	`1`	`+FROM golang:1.24 AS build`
`2`	`2`	`RUN mkdir -p /go/src/github.com/josephburnett/jd`
`3`	`3`	`WORKDIR /go/src/github.com/josephburnett/jd`
`4`	`4`	`COPY . .`
Original file line number	Diff line number	Diff line change
`@@ -13,8 +13,8 @@ require (`
`13`	`13`	`require (`
`14`	`14`	`github.com/go-openapi/swag/jsonname v0.25.4 // indirect`
`15`	`15`	`github.com/kr/text v0.2.0 // indirect`
	`16`	`+ go.yaml.in/yaml/v3 v3.0.4 // indirect`
`16`	`17`	`gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect`
`17`		`- gopkg.in/yaml.v3 v3.0.1 // indirect`
`18`	`18`	`)`
`19`	`19`
`20`	`20`	`replace github.com/josephburnett/jd/v2 => ./v2`
Original file line number	Diff line number	Diff line change
`@@ -5,13 +5,12 @@ go 1.24.0`
`5`	`5`	`toolchain go1.24.13`
`6`	`6`
`7`	`7`	`require (`
`8`		`- github.com/go-openapi/jsonpointer v0.22.4`
`9`	`8`	`github.com/stretchr/testify v1.11.1`
`10`		`- gopkg.in/yaml.v3 v3.0.1`
	`9`	`+ go.yaml.in/yaml/v3 v3.0.4`
`11`	`10`	`)`
`12`	`11`
`13`	`12`	`require (`
`14`	`13`	`github.com/davecgh/go-spew v1.1.1 // indirect`
`15`		`- github.com/go-openapi/swag/jsonname v0.25.4 // indirect`
`16`	`14`	`github.com/pmezard/go-difflib v1.0.0 // indirect`
	`15`	`+ gopkg.in/yaml.v3 v3.0.1 // indirect`
`17`	`16`	`)`