dancefinder/dancefetcher
5
0 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Activity

chore(deps): update module golang.org/x/text to v0.41.0 [security] - autoclosed #202

Closed
renovate wants to merge 1 commits from renovate/go-golang.org-x-text-vulnerability into master
pull from: renovate/go-golang.org-x-text-vulnerability
merge into: dancefinder:master
Conversation 1 Commits 1 Files Changed 2
+4 -4
renovate commented 2026-10-14 10:42:26 +00:00
Owner
Copy link
Copy source

This PR contains the following updates:

Package Change Age Confidence
golang.org/x/text v0.31.0 → v0.41.0 age confidence

Infinite loop on invalid input in golang.org/x/text

CVE-2026-56852 / GO-2026-5970

More information

Details

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Panic parsing crafted input in x/text/secure/precis in golang.org/x/text

CVE-2026-56851 / GO-2026-6629

More information

Details

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.31.0` → `v0.41.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.31.0...refs/tags/v0.41.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2ftext/v0.41.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2ftext/v0.31.0/v0.41.0?slim=true) | --- ### Infinite loop on invalid input in golang.org/x/text [CVE-2026-56852](https://nvd.nist.gov/vuln/detail/CVE-2026-56852) / [GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970) <details> <summary>More information</summary> #### Details A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. #### Severity Unknown #### References - [https://go.dev/issue/80142](https://go.dev/issue/80142) - [https://go.dev/cl/794100](https://go.dev/cl/794100) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5970) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Panic parsing crafted input in x/text/secure/precis in golang.org/x/text [CVE-2026-56851](https://nvd.nist.gov/vuln/detail/CVE-2026-56851) / [GO-2026-6629](https://pkg.go.dev/vuln/GO-2026-6629) <details> <summary>More information</summary> #### Details The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. #### Severity Unknown #### References - [https://go.dev/cl/793360](https://go.dev/cl/793360) - [https://go.dev/issue/80112](https://go.dev/issue/80112) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6629) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->
renovate added 1 commit 2026-10-14 10:42:27 +00:00
chore(deps): update module golang.org/x/text to v0.41.0 [security]
dancefetcher / build (pull_request) Successful in 3m38s
Details
dancefetcher / deploy-prod (pull_request) Skipped
Details
b43616d47e
renovate scheduled this pull request to auto merge when all checks succeed 2026-10-14 10:42:27 +00:00
renovate commented 2026-10-14 10:42:27 +00:00
Author
Owner
Copy link
Copy source

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.24.0 -> 1.25.0
### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - The `go` directive was updated for compatibility reasons Details: | **Package** | **Change** | | :---------- | :------------------- | | `go` | `1.24.0` -> `1.25.0` |
renovate changed title from chore(deps): update module golang.org/x/text to v0.41.0 [security] to chore(deps): update module golang.org/x/text to v0.41.0 [security] - autoclosed 2026-10-14 11:03:30 +00:00
renovate closed this pull request 2026-10-14 11:03:31 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 docker
go
security
Pull requests that address a security vulnerability
 severity:moderate
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dancefinder/dancefetcher#202