From bb0eaac7ae4409649a7132fa4cc845bf6109b054 Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sat, 10 Oct 2026 23:44:13 +0200 Subject: [PATCH] security: x/net v0.60.0 (reachable HTTP/2 advisories) govulncheck v1.8.0 (GOTOOLCHAIN=go1.27.2 GOOS=linux) reported the HTTP/2 advisories GO-2026-6603/6610/6611/6612/6617 in golang.org/x/net as called from this repository. They are fixed in x/net v0.60.0 (x/sys, x/text and x/crypto move with it as a lockstep set) and in the go1.27.2 standard library. Called before: corpus: not scannable: `corpus/cmd/corpus` does not compile on the default branch either (`undefined: gluedWords`, main.go:192); not built by CI;.: GO-2026-6617 GO-2026-6612 GO-2026-6611 GO-2026-6610 GO-2026-6603; Called after: corpus: not scannable: `corpus/cmd/corpus` does not compile on the default branch either (`undefined: gluedWords`, main.go:192); not built by CI;.: none; Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 2 +- corpus/go.mod | 4 ++-- corpus/go.sum | 4 ++-- go.mod | 4 ++-- go.sum | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4f50db1..254f4df 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: - uses: actions/setup-go@v7 with: - go-version: "1.27.1" + go-version: "1.27.2" check-latest: true cache: true diff --git a/corpus/go.mod b/corpus/go.mod index b4654e0..fa6aa83 100644 --- a/corpus/go.mod +++ b/corpus/go.mod @@ -1,6 +1,6 @@ module github.com/go-pdfkit/html2pdf/corpus -go 1.27.1 +go 1.27.2 require ( github.com/go-pdfkit/conformance v0.0.0-20260930110009-657c41e8186c @@ -48,7 +48,7 @@ require ( github.com/tannevaled/gobig2 v0.2.0 // indirect golang.org/x/crypto v0.57.0 // indirect golang.org/x/image v0.46.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect diff --git a/corpus/go.sum b/corpus/go.sum index c564175..13a5d58 100644 --- a/corpus/go.sum +++ b/corpus/go.sum @@ -112,8 +112,8 @@ golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ= golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= diff --git a/go.mod b/go.mod index e6bbebb..449a38d 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/go-pdfkit/html2pdf -go 1.27.1 +go 1.27.2 require ( github.com/go-gfx/gfx v0.34.0 @@ -45,7 +45,7 @@ require ( github.com/tannevaled/gobig2 v0.2.0 // indirect golang.org/x/crypto v0.57.0 // indirect golang.org/x/image v0.46.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect diff --git a/go.sum b/go.sum index e17f881..a56fcac 100644 --- a/go.sum +++ b/go.sum @@ -108,8 +108,8 @@ golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ= golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=