unboundsoftware/default-request-adder
6
0
Fork 0
Code Issues 1 Pull Requests 1 Actions 2 Packages Projects Releases 33 Activity

fix(deps): bump golang.org/x/text to v0.39.0 and golang.org/x/net to v0.56.0 #347

Merged
argoyle merged 1 commits from fix-govulncheck-x-text-x-net into main 2026-08-09 19:59:16 +00:00
Conversation 0 Commits 1 Files Changed 2
+12 -12
argoyle commented 2026-08-09 18:41:30 +00:00
Owner
Copy Link
Copy Source

govulncheck was failing in CI.

Findings

ID Module Found Fixed Reachable
GO-2026-5970 golang.org/x/text v0.37.0 v0.39.0 Yes — infinite loop on invalid input, reached via client-go LimitRange.Delete -> norm.Form.* (main.go:83)
GO-2026-5942 golang.org/x/net v0.55.0 v0.56.0 No — panic parsing invalid SVCB/HTTPS RR in dns/dnsmessage, required but not called

Both are indirect dependencies, which Renovate does not bump, so they were updated with go get + go mod tidy. golang.org/x/sys (v0.46.0) and golang.org/x/term (v0.44.0) came along as transitive requirements.

Verification

$ go test -race ./...
?   gitlab.com/unboundsoftware/default-request-adder  [no test files]

$ govulncheck ./...
No vulnerabilities found.

The pending Kubernetes v0.36.3 bump is left to its own Renovate branch.

`govulncheck` was failing in CI. ## Findings | ID | Module | Found | Fixed | Reachable | |----|--------|-------|-------|-----------| | [GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970) | `golang.org/x/text` | v0.37.0 | v0.39.0 | Yes — infinite loop on invalid input, reached via `client-go` `LimitRange.Delete` -> `norm.Form.*` (`main.go:83`) | | [GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942) | `golang.org/x/net` | v0.55.0 | v0.56.0 | No — panic parsing invalid SVCB/HTTPS RR in `dns/dnsmessage`, required but not called | Both are indirect dependencies, which Renovate does not bump, so they were updated with `go get` + `go mod tidy`. `golang.org/x/sys` (v0.46.0) and `golang.org/x/term` (v0.44.0) came along as transitive requirements. ## Verification ``` $ go test -race ./... ? gitlab.com/unboundsoftware/default-request-adder [no test files] $ govulncheck ./... No vulnerabilities found. ``` The pending Kubernetes v0.36.3 bump is left to its own Renovate branch.
argoyle added 1 commit 2026-08-09 18:41:31 +00:00
fix(deps): bump golang.org/x/text to v0.39.0 and golang.org/x/net to v0.56.0
default-request-adder / build (push) Skipped
default-request-adder / test (pull_request) Successful in 1m13s
Details
default-request-adder / vulnerabilities (pull_request) Successful in 1m23s
Details
default-request-adder / build (pull_request) Successful in 1h17m28s
Details
92af2593d5 
Fixes GO-2026-5970 (infinite loop on invalid input in x/text, reachable via client-go) and GO-2026-5942 (panic parsing invalid SVCB/HTTPS RR in x/net/dns/dnsmessage). Renovate does not bump these indirect dependencies.
argoyle scheduled this pull request to auto merge when all checks succeed 2026-08-09 18:42:26 +00:00
argoyle merged commit ad5edfb17a into main 2026-08-09 19:59:16 +00:00
argoyle deleted branch fix-govulncheck-x-text-x-net 2026-08-09 19:59:17 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 docker
go
security
Pull requests that address a security vulnerability
 severity:moderate
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
acctest (Shiny Acctest) argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) peter (Peter Svensson) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unboundsoftware/default-request-adder#347