build: bump x/net + x/text to clear two HIGH/CRITICAL image CVEs#151
Closed
EdHasNoLife wants to merge 1 commit into
Closed
build: bump x/net + x/text to clear two HIGH/CRITICAL image CVEs#151EdHasNoLife wants to merge 1 commit into
EdHasNoLife wants to merge 1 commit into
Conversation
main is red on Image Build (Trivy) as of the last merge, and nothing in that merge caused it -- it was docs-only. Two CVEs were published against indirect deps already in the tree: CVE-2026-46600 golang.org/x/net v0.55.0 -> 0.56.0 (panic parsing an invalid SVCB/HTTPS RR in dns/dnsmessage) CVE-2026-56852 golang.org/x/text v0.37.0 -> 0.39.0 (infinite loop on invalid input) govulncheck stays green because neither path is reachable from our code, but Trivy scans the image SBOM regardless of reachability -- so the gate fires on presence. Bump the deps rather than narrow the gate, matching the standing rule for govulncheck. Blocks every open PR, since Image Build runs on each.
Codex reviewFiles reviewedRoot:
FindingsBlockingNone. Should-fixNone. NitNone. Per-category coverage
Verdictapprove |
Collaborator
Author
|
Superseded by #150, which landed the identical bump ( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mainis red on Image Build (Trivy: 2 HIGH/CRITICAL per image). The last merge was docs-only, so this is a vulnerability-DB update, not a code regression — two CVEs published against indirect deps already in the tree.golang.org/x/netgolang.org/x/textgovulncheckstays green — neither path is reachable from our code. Trivy scans the image SBOM regardless of reachability, so the gate fires on presence alone.continue-on-error.go.mod/go.sumonly;make pre-prclean (no generated-code drift).Unblocks every open PR — Image Build runs on all of them.