unboundsoftware/default-request-adder
6
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases 33 Activity

fix(deps): bump golang.org/x/text to v0.39.0 and golang.org/x/net to v0.56.0 (#347)
Unbound Release / Check Preconditions (push) Successful in 26s
Details
Unbound Release / Create Tag (push) Skipped
Details
default-request-adder / vulnerabilities (push) Successful in 1m0s
Details
default-request-adder / test (push) Successful in 1m10s
Details
Unbound Release / Generate Changelog and Handle PR (push) Successful in 44s
Details
Unbound Release / Create Release (push) Failing after 59s
Details
Release / release (push) Failing after 1m44s
Details
default-request-adder / build (push) Successful in 1h3m53s
Details

Browse Source 
`govulncheck` was failing in CI.

## Findings

| ID | Module | Found | Fixed | Reachable |
|----|--------|-------|-------|-----------|
| [GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970) | `golang.org/x/text` | v0.37.0 | v0.39.0 | Yes — infinite loop on invalid input, reached via `client-go` `LimitRange.Delete` -> `norm.Form.*` (`main.go:83`) |
| [GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942) | `golang.org/x/net` | v0.55.0 | v0.56.0 | No — panic parsing invalid SVCB/HTTPS RR in `dns/dnsmessage`, required but not called |

Both are indirect dependencies, which Renovate does not bump, so they were updated with `go get` + `go mod tidy`. `golang.org/x/sys` (v0.46.0) and `golang.org/x/term` (v0.44.0) came along as transitive requirements.

## Verification

```
$ go test -race ./...
?   gitlab.com/unboundsoftware/default-request-adder  [no test files]

$ govulncheck ./...
No vulnerabilities found.
```

The pending Kubernetes v0.36.3 bump is left to its own Renovate branch.

Reviewed-on: #347
This commit was merged in pull request #347.
This commit is contained in:
argoyle
2026-08-09 19:59:14 +00:00
parent 63fb9babb5
commit ad5edfb17a
2 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+4 -4
View File
@@ -29,11 +29,11 @@ require (
github.com/x448/float16 v0.8.4 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/net v0.55.0 // indirect
golang.org/x/net v0.56.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sys v0.45.0 // indirect
golang.org/x/term v0.43.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/sys v0.46.0 // indirect
golang.org/x/term v0.44.0 // indirect
golang.org/x/text v0.39.0 // indirect
golang.org/x/time v0.14.0 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect