Repository navigation
fix(deps): update Go, x/net, and grpc for security fixes - #4
Merged
Merged
Conversation
govulncheck fails on main with two reachable vulnerabilities: - GO-2026-6617 in golang.org/x/net v0.59.0, fixed in v0.60.0. - GO-2026-6613 in the Go 1.27.1 standard library (net/http), fixed in Go 1.27.2. Source and container builds now use Go 1.27.2, and x/net advances to v0.60.0. The linter advances to v2.14.0 so it can read Go 1.27.2's compiled package data; the remaining Go changes address the findings the newer linter reports. Backport of upstream kenn-io#1185. (cherry picked from commit 7ca2f51) Co-authored-by: Rod Boev <rodboev@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01793XPgu1pMcfXjFd423RNP
Updates the indirect google.golang.org/grpc dependency from v1.83.1 to v1.83.2, which fixes a server panic on HTTP/2 requests that carry neither :authority nor Host (GO-2026-6443). govulncheck reports the package as imported but not called; this is a preventive update. Only go.mod and go.sum change. Matches upstream kenn-io#1220. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01793XPgu1pMcfXjFd423RNP
Go 1.27.2 writes export data version 5, which the x/tools v0.49.0 importer cannot read, so `make testify-helper-check` (and therefore `make lint-ci`) fails on every package. x/tools v0.50.0 reads the new format; x/telemetry follows as its indirect requirement. This matches the x/tools version upstream already uses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01793XPgu1pMcfXjFd423RNP
golangci-lint v2.14.0's modernize check reports the LastIndex slicing in the Circleback and Granola importers' emailDomain helpers. CutLast returns the same suffix, and an empty string when the address has no "@", so behavior is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01793XPgu1pMcfXjFd423RNP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
make vulncheckfails onmainwith two reachable vulnerabilities. This PR clears both and keeps the lint lane working on the new toolchain.Advisories
golang.org/x/netv0.59.0net/http)google.golang.org/grpcv1.83.1 (imported, not called)What changes
go.modmoves togo 1.27.2. CI reads the version fromgo.mod, and both Dockerfiles move togolang:1.27.2-bookworm(the release image keeps a digest pin).Makefile,.custom-gcl.yml) so it can read Go 1.27.2 package data. The smallstrings.CutLastrewrites address the new linter's modernize findings and do not change behavior.testify-helper-checkcannot read.The Go, x/net, and linter changes are a backport of upstream kenn-io#1185; the grpc bump matches kenn-io#1220.
govulncheckstill lists GO-2026-5932 (golang.org/x/crypto/openpgpis unmaintained) at module level only. msgvault does not import that package, and no fixed version exists.🤖 Generated with Claude Code
https://claude.ai/code/session_01793XPgu1pMcfXjFd423RNP