Repository navigation
chore: update dependencies - #312
Open
bjoernr-de wants to merge 5 commits into
Open
bjoernr-de wants to merge 5 commits into
bjoernr-de wants to merge 5 commits into
Conversation
Go 1.25 no longer receives security fixes for several advisories, so move the toolchain to go1.26.9 and align the promu build and CI images to the 1.26 series. Resolves: GO-2026-6604, GO-2026-6612, GO-2026-6613, GO-2026-6607, GO-2026-6611, GO-2026-6603, GO-2026-6610, GO-2026-6608, GO-2026-6609, GO-2026-6605, GO-2026-6090, GO-2026-6089, GO-2026-5972, GO-2026-5026, GO-2026-4970, CVE-2026-56864, CVE-2026-56865, CVE-2026-46600 Refs: Lusitaniae#311
Upgrade golang.org/x/text from v0.38.0 to v0.42.0 to resolve GO-2026-5970 (fixed in v0.39.0) and GO-2026-6629 (fixed in v0.41.0). The new release requires Go 1.26, so the go directive is raised to 1.26.0 and golang.org/x/sync is upgraded to v0.23.0 as a transitive requirement. Refs: Lusitaniae#311
Upgrade golang.org/x/crypto from v0.53.0 to v0.57.0 to resolve GO-2026-6303 (fixed in v0.55.0), GO-2026-6354 and GO-2026-6355 (fixed in v0.56.0). golang.org/x/net is raised to v0.58.0 and golang.org/x/sys to v0.48.0 as transitive requirements. Refs: Lusitaniae#311
Upgrade golang.org/x/net from v0.58.0 to v0.60.0 to resolve GO-2026-6612, GO-2026-6610, GO-2026-6611 and GO-2026-6603 (all fixed in v0.60.0). Refs: Lusitaniae#311
The prebuilt golangci-lint v2.7.2 binaries are compiled with go1.25.4 and refuse to lint a module targeting a newer Go version, which breaks the lint step after the toolchain moved to go1.26.9: can't load config: the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.9) v2.14.0 is built with go1.27.0 and reports no issues on the codebase. Update the pin in Makefile.common and the CI workflow, which must be kept in sync. Refs: Lusitaniae#311
bjoernr-de
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #311
What was upgraded and why
fix(deps): bump Go toolchain to 1.26.9 to resolve stdlib CVEsgo1.25.11→go1.26.9;.promu.ymland CI (golang-builder,setup-go) moved to Go 1.26fix(deps): bump golang.org/x/text to v0.42.0golang.org/x/textv0.38.0 → v0.42.0fix(deps): bump golang.org/x/crypto to v0.57.0golang.org/x/cryptov0.53.0 → v0.57.0fix(deps): bump golang.org/x/net to v0.60.0golang.org/x/net→ v0.60.0build(lint): bump golangci-lint to v2.14.0golangci-lintv2.7.2 → v2.14.0 inMakefile.commonand CIWhy Go 1.26 and not a newer 1.25 patch release
Most findings are in the standard library (
net/http,crypto/tls,os,net/textproto,html/template,encoding/asn1,net/url). They can only be fixed by recompiling with a patched Go. Several of the newest advisories, including the CRITICAL GO-2026-6604 and GO-2026-6612, are fixed only in go1.26.9 / go1.27.2 and have no 1.25 backport. Staying on Go 1.25 would leave them open, so the toolchain moves to go1.26.9..promu.ymland.github/workflows/ci.ymlare updated together, as the comments in both files require.Why the
godirective is now 1.26.0golang.org/x/textv0.42.0 andgolang.org/x/netv0.60.0 require Go ≥ 1.26, sogo mod tidyraised thegoline ingo.modfrom1.25.0to1.26.0. Building from source now needs Go 1.26 or newer.Transitive bumps
The new x/crypto and x/net releases require newer versions of their siblings, so these were upgraded as well:
golang.org/x/sysv0.46.0 → v0.48.0golang.org/x/syncv0.21.0 → v0.23.0Why golangci-lint is bumped
The prebuilt golangci-lint v2.7.2 binaries are compiled with go1.25.4, and golangci-lint refuses to lint a module that targets a newer Go version:
v2.14.0 binaries are built with go1.27.0. The version is updated in both
Makefile.commonand.github/workflows/ci.yml, as the comments in those files require.