Repository navigation
Bump golang.org/x/net to v0.61.0 and related x/* deps - #286
Closed
surlymochan wants to merge 2 commits into
Closed
surlymochan wants to merge 2 commits into
surlymochan wants to merge 2 commits into
Conversation
x/net v0.56.0 is affected by HTTP/2 advisories fixed in v0.60.0+. Also refreshes x/text (CVE-2026-56851), x/crypto, x/sys, and x/sync pulled in by those releases. go build ./... and non-Maven packages' tests pass. govulncheck is clean for x/net and x/text; remaining openpgp finding is unfixed upstream in x/crypto and unrelated to this bump.
x/net v0.60.0+ requires Go 1.26, so align the license-eye-check workflow, the Dockerfile builder image, and golangci-lint (v2.9.0 is the first release built with Go 1.26) with the go directive.
Author
|
CI was failing because x/net v0.60.0+ requires Go 1.26 while the lint job ran golangci-lint v2.6.1 (built with Go 1.25) and license-eye-check pinned Go 1.25. Pushed a follow-up that moves golangci-lint to v2.9.0 (first release built with Go 1.26; |
wu-sheng
added a commit
that referenced
this pull request
Oct 18, 2026
golang.org/x/net v0.56.0 is affected by the HTTP/2 advisories fixed in v0.60.0 (GO-2026-6603/6610/6611/6612/6617), and x/text v0.39.0 by CVE-2026-56851 (GO-2026-6629, fixed in v0.41.0). Every fixed x/* release requires go >= 1.26.0, so move the toolchain to Go 1.27 everywhere: - go.mod: go 1.27.0; x/net v0.61.0, x/text v0.43.0, x/crypto v0.58.0, x/sys v0.49.0, x/sync v0.24.0, x/tools v0.52.0, x/mod v0.42.0, x/term v0.47.0. - action.yml, header/action.yml, dependency/action.yml: setup-go 1.27. setup-go exports GOTOOLCHAIN=local, so leaving these on 1.25 would fail `make install` for every downstream user of the actions. - CI workflow, Dockerfile builder image and examples/golang: Go 1.27. - golangci-lint v2.15.0 (built with go1.27). Install it from https://golangci-lint.run/install.sh: the script on the frozen `master` branch picks the .sbom.json checksum and fails for every release since v2.12.2. - goconst 1.10 began checking composite literals by default; exclude them to keep the previous lint scope. Mark a read-only gemspec os.Open as a gosec G703 false positive. - Repin docker/login-action to v4.6.0. The v4.2.0 SHA was dropped from the ASF allow-list, and publish-docker has hit startup_failure on main since #284. Supersedes #286.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps
golang.org/x/netv0.56.0 → v0.61.0 (HTTP/2 advisories fixed in v0.60.0+), and refreshes the relatedx/text(CVE-2026-56851),x/crypto,x/sys, andx/syncreleases those pulls require.godirective moves to 1.26.0 to match other SkyWalking Go modules on the same toolchain.Test
go build ./...passesgo testfor non-Maven packages passes (pkg/depsMaven resolution needsmvn/mvnwin the environment; unchanged by this bump)govulncheck ./...no longer reports the x/net or x/text advisories. Remaining finding is the unfixedx/crypto/openpgpadvisory (N/A fixed version), unrelated to this bump.