Skip to content

fix(deps): bump golang.org/x/net to v0.61.0 for two HTTP/2 CVEs - #251

Closed
teemow wants to merge 1 commit into
giantswarmfrom
fork/x-net-v0.61.0-2
Closed

teemow wants to merge 1 commit into
giantswarmfrom
fork/x-net-v0.61.0-2

Conversation

@teemow

@teemow teemow commented Oct 10, 2026

Copy link
Copy Markdown
Member

golang.org/x/net below v0.61.0 carries CVE-2026-97032 and CVE-2026-78663, two HTTP/2 vulnerabilities.

go get golang.org/x/net@v0.61.0 && go mod tidy in every module that required it below v0.61.0: go.mod, hack/tools/{code-generator,controller-gen,go-licenses,ko}, internal/plugins/gcp-secret-manager and tools/apitool; the golang.org/x/sync, x/sys, x/term, x/text and x/tools versions it pulls along come with it, and tidy drops the stale indirect requirements hack/tools/code-generator/go.mod still listed (go mod tidy -diff on the unchanged file removes the same lines). One carried commit on the giantswarm line, rebase-merged; FORK.md carries its row. Nothing else changes.

@teemow

teemow commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

From Timo's agent: replaced by #252, the same bump with the root module re-vendored (the CircleCI builds compile with -mod=vendor) and the ledger row naming its pull request (one carried commit on a fresh branch instead of a force push).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant