From 4066218e7927f3cf37b78b54794adc2060fe68f4 Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sat, 10 Oct 2026 23:43:22 +0200 Subject: [PATCH] security: x/net v0.60.0 (reachable HTTP/2 advisories) govulncheck v1.8.0 (GOTOOLCHAIN=go1.27.2 GOOS=linux) reported the HTTP/2 advisories GO-2026-6603/6610/6611/6612/6617 in golang.org/x/net as called from this repository. They are fixed in x/net v0.60.0 (x/sys, x/text and x/crypto move with it as a lockstep set) and in the go1.27.2 standard library. Called before: .: GO-2026-6617 GO-2026-6612 GO-2026-6611 GO-2026-6603; Called after: .: none; Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 2 +- go.mod | 4 ++-- go.sum | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0724ac4..37d7830 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: - uses: actions/setup-go@v7 with: - go-version: "1.27.1" + go-version: "1.27.2" check-latest: true cache: true diff --git a/go.mod b/go.mod index cc44aa6..c2bec8e 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/go-pdfkit/pdfkit -go 1.27.1 +go 1.27.2 require ( github.com/go-opentype/opentype v0.15.0 @@ -31,7 +31,7 @@ require ( github.com/sergeymakinen/go-ico v1.0.0 // indirect github.com/tannevaled/gobig2 v0.2.0 // indirect golang.org/x/image v0.46.0 // indirect - golang.org/x/net v0.58.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect diff --git a/go.sum b/go.sum index ecc74a0..c1b9e35 100644 --- a/go.sum +++ b/go.sum @@ -54,8 +54,8 @@ github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZ github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E= golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ= golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=