#30 Update golang and libraries to resolve CVE

[nathanlaceyraft]

Following PR will resolve #30

datarhei/restreamer has CVE's because of core

CVE's in core found by doing
govulncheck ./...

=== Symbol Results ===

Vulnerability #1: GO-2025-3595
Incorrect Neutralization of Input During Web Page Generation in x/net in
golang.org/x/net
More info: https://pkg.go.dev/vuln/GO-2025-3595
Module: golang.org/x/net
Found in: golang.org/x/[email protected]
Fixed in: golang.org/x/[email protected]

Vulnerability #2: GO-2025-3553
Excessive memory allocation during header parsing in
github.com/golang-jwt/jwt
More info: https://pkg.go.dev/vuln/GO-2025-3553
Module: github.com/golang-jwt/jwt
Found in: github.com/golang-jwt/[email protected]+incompatible
Fixed in: N/A
Example traces found:
#1: http/middleware/session/HLS.go:20:2: session.init calls middleware.init, which calls jwt.init

Module: github.com/golang-jwt/jwt/v4
Found in: github.com/golang-jwt/jwt/[email protected]
Fixed in: github.com/golang-jwt/jwt/[email protected]
Example traces found:
#1: http/server.go:402:20: http.server.ServeHTTP calls echo.Echo.ServeHTTP, which eventually calls jwt.Parser.ParseUnverified

Module: github.com/golang-jwt/jwt/v5
Found in: github.com/golang-jwt/jwt/[email protected]
Fixed in: github.com/golang-jwt/jwt/[email protected]
Example traces found:
#1: http/jwt/validator.go:114:36: jwt.auth0Validator.Validate calls jwt.Parser.ParseUnverified

Vulnerability #3: GO-2024-3250
Improper error handling in ParseWithClaims and bad documentation may cause
dangerous situations in github.com/golang-jwt/jwt
More info: https://pkg.go.dev/vuln/GO-2024-3250
Module: github.com/golang-jwt/jwt/v4
Found in: github.com/golang-jwt/jwt/[email protected]
Fixed in: github.com/golang-jwt/jwt/[email protected]
Example traces found:
#1: http/server.go:402:20: http.server.ServeHTTP calls echo.Echo.ServeHTTP, which eventually calls jwt.ParseWithClaims

Vulnerability #4: GO-2024-2920
Denial of service vulnerability via the parseDirectives function in
github.com/vektah/gqlparser
More info: https://pkg.go.dev/vuln/GO-2024-2920
Module: github.com/vektah/gqlparser/v2
Found in: github.com/vektah/gqlparser/[email protected]
Fixed in: github.com/vektah/gqlparser/[email protected]
Example traces found:
#1: http/handler/api/graph.go:46:26: api.GraphHandler.Query calls handler.Server.ServeHTTP, which eventually calls parser.ParseQuery
#2: http/graph/graph/graph.go:1832:44: graph.init calls gqlparser.MustLoadSchema, which eventually calls parser.ParseSchemas

---

Steps to repoduce creating this PR
update to new golang 1.24.3 (if not already there)

go get github.com/golang-jwt/jwt/v4

go get github.com/vektah/gqlparser/v2

go get golang.org/x/net

go get github.com/labstack/echo-jwt

go get github.com/golang-jwt/jwt/v5

go get github.com/labstack/echo/v4
//resolves the github.com/golang-jwt/[email protected] reference

Because of breaking changes in echo/v4, I had to make a fix to http/jwt/jwt.go

go mod tidy
go mod vendor

govulncheck ./...
should now show no CVE's

I also update the .github files and the Dockerfiles to update to newest golang version 1.24.3
Note the adding of @sha256:b4f875e650466fa0fe62c6fd3f02517a392123eea85f1d7e69d85f780e4db1c1 within the image definition.
If dockerhub ever received a supply chain attack, corrupting the base images, the hash would prevent you from releasing a images.

Once you build the docker image, you can recheck for CVE's using trivy
trivy image --scanners vuln --ignore-unfixed local:core

trivy will now show 0 CVE's

thanks for your consideration