Repository navigation
fix(deps): clear the vulnerability gate with a patched toolchain and x/net bump - #40
Merged
Merged
Conversation
…x/net bump The quality job's govulncheck step fails on main as well as on any branch: the vulnerability database has picked up standard-library advisories that affect the declared Go 1.26.6 (net/http and its HTTP/2 internals, mime/multipart, crypto/tls, os, net/textproto) plus two module advisories, golang.org/x/net v0.57.0 and golang.org/x/image v0.28.0. Take the smallest bump that clears them, which keeps the repository on its 1.26 line rather than moving to 1.27: the go directive moves to 1.26.9, the first 1.26 patch the advisories name as fixed, golang.org/x/net to v0.60.0 and golang.org/x/image to v0.43.0, with the transitive x/mod, x/sync, x/sys, x/telemetry, x/text and x/tools companions they require. Verified with the declared toolchain, which is the one setup-go installs from go.mod: `go tool govulncheck ./...` reports 0 vulnerabilities and exits 0, where the declared 1.26.6 reported 14 affected, 10 of them reachable from the standard library. `go test ./... -count=1` passes 89 packages, the repository's own race gate (`go-test.sh -race -p 2 ./agent/... ./internal/coding/...`) passes, `go mod verify` and `make deps-check` are clean, and golangci-lint reports 0 issues.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
Go quality and securityjob fails onmainright now, not just on a branch: itsgovulncheckstep reports standard-library advisories that affect the declared Go 1.26.6, plus two module advisories. The database moved after the last greenQualityrun (2026-10-08 15:12Z), so every push tomainfails the same step.Reproduced on pristine
origin/mainbefore changing anything:The bump
The smallest change that clears it, staying on the repository's 1.26 line rather than moving to 1.27:
godirective1.26.61.26.9net/http, HTTP/2 internals,mime/multipart,crypto/tls,os,net/textproto)golang.org/x/netv0.57.0v0.60.0golang.org/x/imagev0.28.0v0.43.0x/modv0.41.0,x/syncv0.23.0,x/sysv0.48.0,x/telemetry20260811,x/textv0.42.0,x/toolsv0.49.0CI installs its toolchain from
go-version-file: go.mod, so thegodirective is the only place the standard-library version is chosen.Verification, with the declared toolchain
go tool govulncheck ./...→ 0 vulnerabilities, exit 0 (was 14 affected, 10 reachable from the standard library)go test ./... -count=1→ 89 packagesokbash .github/scripts/go-test.sh -race -p 2 ./agent/... ./internal/coding/...→ exit 0go mod verify→ all modules verified;make deps-check→ all three policies OKgolangci-lint run --new-from-rev=origin/main ./...→ 0 issuesNo code changes: this is the toolchain and two modules only.
Note
golang.org/x/imageis an indirect dependency (it arrives through the clipboard and image-attachment paths), and its advisories are abouttiffdecoding, reachable frominternal/coding/clipboardandinternal/coding/attachment. Worth knowing that the reachable set is real, not theoretical.