Bump golang.org/x/net to v0.55.0 to fix GO-2026-5026 - #257
Merged
Conversation
golang.org/x/net v0.54.0 is affected by GO-2026-5026 (idna: failure to reject ASCII-only Punycode-encoded labels), reachable from the TLS certificate path via certmagic's GetCertificate -> idna.ToASCII. govulncheck confirmed the trace before the bump and reports zero affected vulnerabilities after. x/sys is pulled to v0.45.0 as a transitive requirement. Vendored tree updated to match.
umputun
approved these changes
Jul 4, 2026
umputun
left a comment
umputun
left a comment
Owner
There was a problem hiding this comment.
lgtm, verified independently before signing off:
- go.sum for x/net v0.55.0 and x/sys v0.45.0 matches
sum.golang.orgexactly - vendor diff is scoped to x/net + x/sys + modules.txt only, and a fresh
go mod vendorregenerates byte-identical to this tree govulncheck ./...shows GO-2026-5026 reachable viaapp/proxy/ssl.go:206on master and 0 affecting the code after the bump- build + vet +
go mod verifyclean
thx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
golang.org/x/netv0.54.0 is affected by GO-2026-5026 (idna: failure to reject ASCII-only Punycode-encoded labels). It is reachable in reproxy from the TLS certificate path:proxy.cmmanager.GetCertificate→ certmagicConfig.GetCertificate→idna.ToASCII.govulncheck ./...reported the trace before the bump and reports zero affected vulnerabilities after.This bumps
golang.org/x/netto v0.55.0 (the fixed release), which pullsgolang.org/x/systo v0.45.0 transitively. The vendored tree is regenerated withgo mod vendorto match. Both remain indirect dependencies; no direct dependencies were added.