From f9b5da2931fe8fd6e17be0d74a0db26883ddfdf3 Mon Sep 17 00:00:00 2001 From: tannevaled Date: Sat, 10 Oct 2026 22:42:16 +0200 Subject: [PATCH] Require golang.org/x/net v0.60.0: four reachable HTTP/2 vulnerabilities govulncheck (symbol level, with go1.27.2) reached GO-2026-6603, -6611, -6612 and -6617 in golang.org/x/net/http2 v0.58.0, through google.golang.org/grpc. x/net is an indirect requirement here, which Renovate does not update, so its dependency PRs left it behind; toolkit, where it is direct, already moved. With v0.60.0: go test ./... passes and govulncheck reports nothing. Co-Authored-By: Claude Opus 5.5 --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 081c462..7054c72 100644 --- a/go.mod +++ b/go.mod @@ -30,7 +30,7 @@ require ( github.com/sergeymakinen/go-ico v1.0.0 // indirect github.com/tannevaled/gobig2 v0.2.0 // indirect golang.org/x/image v0.46.0 // indirect - golang.org/x/net v0.58.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect diff --git a/go.sum b/go.sum index 8a83b4f..9258c3e 100644 --- a/go.sum +++ b/go.sum @@ -54,8 +54,8 @@ github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZ github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E= golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ= golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=