Skip to content

fix(deps): bump modules with known vulnerabilities - #780

Merged
Mzack9999 merged 1 commit into
devfrom
dwisiswant0/fix/deps/bump-modules-with-known-vulnerabilities
Nov 9, 2026
Merged

Mzack9999 merged 1 commit into
devfrom
dwisiswant0/fix/deps/bump-modules-with-known-vulnerabilities

Conversation

@dwisiswant0

@dwisiswant0 dwisiswant0 commented Nov 8, 2026 •

Copy link
Copy Markdown
Member

Proposed changes

On dev, govulncheck reports 9 vulnerabilities from 5 modules in code
that proxify calls. Bump each module to the lowest version that fixes
them.

golang.org/x/net goes from v0.59.0 to v0.60.0 for GO-2026-6603,
GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617.
github.com/klauspost/compress goes from v1.18.2 to v1.20.2 for
GO-2026-6865, github.com/andybalholm/brotli from v1.2.0 to v1.2.7 for
GO-2026-6888, and github.com/yuin/goldmark from v1.7.4 to v1.7.17 for
GO-2026-5320.

github.com/elazarl/goproxy goes from
v0.0.0-20221015165544-a0805db90819 to the untagged revision
v0.0.0-20230731152917-f99041a5c027 for GO-2023-1941. That revision is
the fixed version the advisory lists, and goproxy had no tags until
v1.2.1 in December 2024.

The go line stays at 1.26.10, so dependents need no newer Go and the
default GODEBUG settings stay the same.

dev already clears the other advisories that #779 lists for called
code. govulncheck still reports GO-2026-5932 in golang.org/x/crypto
v0.57.0, and GO-2026-6860 and GO-2026-6866 in golang.org/x/net v0.60.0,
but not in code that proxify calls.

Fixes: #779

Checklist

  • Pull request is created against the dev branch
  • All checks passed (lint, unit/integration/regression tests etc.) with my changes
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate) (N/A)

@dwisiswant0
dwisiswant0 force-pushed the dwisiswant0/fix/deps/bump-modules-with-known-vulnerabilities branch from 4463be6 to 250e135 Compare November 9, 2026 00:44
@dwisiswant0
dwisiswant0 changed the base branch from main to dev November 9, 2026 00:44
On dev, govulncheck reports 9 vulnerabilities from 5 modules in code
that proxify calls. Bump each module to the lowest version that fixes
them.

golang.org/x/net goes from v0.59.0 to v0.60.0 for GO-2026-6603,
GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617.
github.com/klauspost/compress goes from v1.18.2 to v1.20.2 for
GO-2026-6865, github.com/andybalholm/brotli from v1.2.0 to v1.2.7 for
GO-2026-6888, and github.com/yuin/goldmark from v1.7.4 to v1.7.17 for
GO-2026-5320.

github.com/elazarl/goproxy goes from
v0.0.0-20221015165544-a0805db90819 to the untagged revision
v0.0.0-20230731152917-f99041a5c027 for GO-2023-1941. That revision is
the fixed version the advisory lists, and goproxy had no tags until
v1.2.1 in December 2024.

The go line stays at 1.26.10, so dependents need no newer Go and the
default GODEBUG settings stay the same.

dev already clears the other advisories that #779 lists for called
code. govulncheck still reports GO-2026-5932 in golang.org/x/crypto
v0.57.0, and GO-2026-6860 and GO-2026-6866 in golang.org/x/net v0.60.0,
but not in code that proxify calls.

Fixes: #779
Signed-off-by: Dwi Siswanto <git@dw1.io>
@dwisiswant0
dwisiswant0 force-pushed the dwisiswant0/fix/deps/bump-modules-with-known-vulnerabilities branch from 250e135 to 27aadea Compare November 9, 2026 01:39
@dwisiswant0
dwisiswant0 requested a review from Mzack9999 November 9, 2026 06:24
@Mzack9999
Mzack9999 merged commit 6c95e87 into dev Nov 9, 2026
7 checks passed
@Mzack9999
Mzack9999 deleted the dwisiswant0/fix/deps/bump-modules-with-known-vulnerabilities branch November 9, 2026 10:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

govulncheck reports 21 vulnerabilities in called code

2 participants