Security: devalue 5.9.4, x/net 0.60.0, Go 1.26.9 CI image #18
Merged
jcoffey-dev
merged 2 commits from 2026-10-09 07:41:49 +00:00
deps/devalue-5.9.3 into main
2
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 jcoffey-dev
|
a69093fff7 |
go: x/net 0.60.0 and the Go 1.26.9 CI image (GO-2026-6612, -6613, -6617)
ci / rust-licenses (agent) (pull_request) Skipped
ci / rust-licenses (search) (pull_request) Skipped
ci / go-licenses (alerting) (pull_request) Skipped
ci / go-licenses (api) (pull_request) Skipped
ci / go-licenses (deploy/operator) (pull_request) Skipped
ci / go-licenses (enterprise) (pull_request) Skipped
ci / go-licenses (hack/benchmark-fixture) (pull_request) Skipped
ci / go-licenses (hack/windows-fixture) (pull_request) Skipped
ci / go-licenses (ingest) (pull_request) Skipped
ci / go-licenses (proto) (pull_request) Skipped
ci / go-licenses (terraform) (pull_request) Skipped
ci / npm-licenses (pull_request) Skipped
github/ci (branch) GitHub Actions
ci / github (pull_request) Successful in 6m43s
ci / rust-advisories (agent) (pull_request) Skipped
ci / rust-advisories (search) (pull_request) Skipped
ci / go-vulncheck (alerting) (pull_request) Skipped
ci / go-vulncheck (api) (pull_request) Skipped
ci / go-vulncheck (deploy/operator) (pull_request) Skipped
ci / go-vulncheck (enterprise) (pull_request) Skipped
ci / go-vulncheck (hack/benchmark-fixture) (pull_request) Skipped
ci / go-vulncheck (hack/windows-fixture) (pull_request) Skipped
ci / go-vulncheck (ingest) (pull_request) Skipped
ci / go-vulncheck (proto) (pull_request) Skipped
ci / go-vulncheck (terraform) (pull_request) Skipped
ci / npm-audit (pull_request) Skipped
ci / tenant-boundary (pull_request) Skipped
ci / web-routes (pull_request) Skipped
ci / conformance-corpus (pull_request) Skipped
govulncheck started failing on main: golang.org/x/net 0.58.0 has an HTTP/2 HPACK encoder race that can crash a server (GO-2026-6617, fixed in 0.60.0), and the Go 1.26.8 toolchain in the pinned CI image has three net/http fixes pending (GO-2026-6612, GO-2026-6613, fixed in 1.26.9). - x/net 0.60.0 in every module that uses it, with the x/sys, x/text and x/term patch releases it pulls in; proto and the two fixtures move to go 1.26, which x/net 0.60.0 requires and CI already builds with. - The golang:1.26-bookworm image is re-pinned to today's digest (1.26.9) in both the Gitea and GitHub workflows. The Dockerfiles use the floating golang:1.26-alpine tag and pick up 1.26.9 on their next build. go build and govulncheck are clean in all nine modules. |
||
|
jcoffey-dev
|
b6b7aca49f |
web: bump devalue to 5.9.4 (GHSA-j22f-vq7h-c4qm)
ci / go-licenses (alerting) (pull_request) Skipped
ci / go-licenses (api) (pull_request) Skipped
ci / go-licenses (deploy/operator) (pull_request) Skipped
github/ci (branch) GitHub Actions
ci / github (pull_request) Failing after 4m42s
ci / rust-advisories (agent) (pull_request) Skipped
ci / rust-advisories (search) (pull_request) Skipped
ci / go-vulncheck (alerting) (pull_request) Skipped
ci / go-vulncheck (api) (pull_request) Skipped
ci / go-vulncheck (deploy/operator) (pull_request) Skipped
ci / go-vulncheck (enterprise) (pull_request) Skipped
ci / go-vulncheck (hack/benchmark-fixture) (pull_request) Skipped
ci / go-vulncheck (hack/windows-fixture) (pull_request) Skipped
ci / go-vulncheck (ingest) (pull_request) Skipped
ci / rust-licenses (agent) (pull_request) Skipped
ci / rust-licenses (search) (pull_request) Skipped
ci / go-licenses (enterprise) (pull_request) Skipped
ci / go-licenses (hack/benchmark-fixture) (pull_request) Skipped
ci / go-licenses (hack/windows-fixture) (pull_request) Skipped
ci / go-licenses (ingest) (pull_request) Skipped
ci / go-licenses (proto) (pull_request) Skipped
ci / go-licenses (terraform) (pull_request) Skipped
ci / npm-licenses (pull_request) Skipped
ci / go-vulncheck (proto) (pull_request) Skipped
ci / go-vulncheck (terraform) (pull_request) Skipped
ci / npm-audit (pull_request) Skipped
ci / tenant-boundary (pull_request) Skipped
ci / web-routes (pull_request) Skipped
ci / conformance-corpus (pull_request) Skipped
devalue 5.9.0, pulled in by SvelteKit and Svelte, is in the range affected by GHSA-j22f-vq7h-c4qm (stringify/uneval serialize shared memory; fixed in 5.9.3). Lockfile-only bump within the existing ^5.8.1 ranges. svelte-check, the build and the route check pass; npm audit --omit=dev is clean. |