Security: devalue 5.9.4, x/net 0.60.0, Go 1.26.9 CI image #18

Merged

jcoffey-dev merged 2 commits from deps/devalue-5.9.3 into main 2026-10-09 07:41:49 +00:00

Conversation 0 Commits 2 Files Changed 19

+75 -75

jcoffey-dev commented 2026-10-09 07:24:16 +00:00

Owner

Copy link

Copy source

Two security updates in one PR, because the second was blocking the first.

web: devalue 5.9.4 (GHSA-j22f-vq7h-c4qm, high). Lockfile-only bump of the SvelteKit/Svelte dependency within ^5.8.1. Checked: npm ci, license allowlist, npm audit --omit=dev, svelte-check, vite build, check-web-routes.

go: x/net 0.60.0 + Go 1.26.9 (GO-2026-6617 HTTP/2 HPACK race crash; GO-2026-6612 / GO-2026-6613 net/http). govulncheck had started failing on main for every PR. x/net 0.60.0 in the eight modules that use it (plus x/sys, x/text, x/term patch releases; proto and the two fixtures move to go 1.26, which x/net 0.60.0 requires). The golang:1.26-bookworm CI image is re-pinned to today's digest (1.26.9) in both the Gitea and GitHub workflows; the Dockerfiles use the floating golang:1.26-alpine tag and pick it up on their next build. Checked: go build and govulncheck clean in all nine modules.

Two security updates in one PR, because the second was blocking the first. **web: devalue 5.9.4** (GHSA-j22f-vq7h-c4qm, high). Lockfile-only bump of the SvelteKit/Svelte dependency within ^5.8.1. Checked: npm ci, license allowlist, npm audit --omit=dev, svelte-check, vite build, check-web-routes. **go: x/net 0.60.0 + Go 1.26.9** (GO-2026-6617 HTTP/2 HPACK race crash; GO-2026-6612 / GO-2026-6613 net/http). govulncheck had started failing on main for every PR. x/net 0.60.0 in the eight modules that use it (plus x/sys, x/text, x/term patch releases; proto and the two fixtures move to go 1.26, which x/net 0.60.0 requires). The golang:1.26-bookworm CI image is re-pinned to today's digest (1.26.9) in both the Gitea and GitHub workflows; the Dockerfiles use the floating golang:1.26-alpine tag and pick it up on their next build. Checked: go build and govulncheck clean in all nine modules.

jcoffey-dev added 1 commit 2026-10-09 07:24:16 +00:00

web: bump devalue to 5.9.4 (GHSA-j22f-vq7h-c4qm) ... b6b7aca49f

devalue 5.9.0, pulled in by SvelteKit and Svelte, is in the range affected by
GHSA-j22f-vq7h-c4qm (stringify/uneval serialize shared memory; fixed in
5.9.3). Lockfile-only bump within the existing ^5.8.1 ranges. svelte-check,
the build and the route check pass; npm audit --omit=dev is clean.

jcoffey-dev added 1 commit 2026-10-09 07:34:42 +00:00

go: x/net 0.60.0 and the Go 1.26.9 CI image (GO-2026-6612, -6613, -6617) ... a69093fff7

govulncheck started failing on main: golang.org/x/net 0.58.0 has an HTTP/2
HPACK encoder race that can crash a server (GO-2026-6617, fixed in 0.60.0),
and the Go 1.26.8 toolchain in the pinned CI image has three net/http fixes
pending (GO-2026-6612, GO-2026-6613, fixed in 1.26.9).

- x/net 0.60.0 in every module that uses it, with the x/sys, x/text and
  x/term patch releases it pulls in; proto and the two fixtures move to
  go 1.26, which x/net 0.60.0 requires and CI already builds with.
- The golang:1.26-bookworm image is re-pinned to today's digest (1.26.9) in
  both the Gitea and GitHub workflows. The Dockerfiles use the floating
  golang:1.26-alpine tag and pick up 1.26.9 on their next build.

go build and govulncheck are clean in all nine modules.

jcoffey-dev changed title from web: bump devalue to 5.9.4 (GHSA-j22f-vq7h-c4qm) to Security: devalue 5.9.4, x/net 0.60.0, Go 1.26.9 CI image 2026-10-09 07:35:05 +00:00

jcoffey-dev merged commit 663acf2943 into main 2026-10-09 07:41:49 +00:00

jcoffey-dev deleted branch deps/devalue-5.9.3 2026-10-09 07:41:49 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

dependencies

Dependency updates

documentation

Docs, README or site copy

duplicate

Already tracked elsewhere

enhancement

New feature or improvement

good first issue

Good for newcomers

help wanted

Contributions welcome

invalid

Not a valid issue

needs info

Waiting on the reporter for details

question

Needs an answer, not a code change

security

Security issue or hardening

translation

New language or translation fixes

wontfix

Will not be worked on

priority

p1

High priority

priority

p2

Medium priority

priority

p3

Low priority

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jcoffey-dev (John Coffey)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coffey-labs/cairnobs#18