Repository navigation
Bump golang.org/x/net to v0.60.0 for GO-2026-6617 - #880
Conversation
x/net v0.59.0 carries five advisories fixed in v0.60.0, all in its http2 package: GO-2026-6617 (CVE-2026-78669, HIGH: a peer that opens many streams and then sends many small SETTINGS frames burns the CPU), GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603. govulncheck finds the CLI calling the affected code, and Trivy fails the security scan on the HIGH one. nix/package.nix gets the vendorHash the new go.sum needs, recomputed and verified with make update-nix-hash.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 3 files
You’re at about 92% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.
There was a problem hiding this comment.
🟢 Approved
The dependency version, checksums, and required Nix vendor hash are updated consistently.
0 open findings
What changed in this PR
Updates golang.org/x/net to v0.60.0, resolving five HTTP/2 security advisories.
Changes:
- Bumps
x/netfrom v0.59.0 to v0.60.0. - Updates module checksums and the Nix vendor hash.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
| File | Description |
|---|---|
go.mod |
Updates the direct dependency version. |
go.sum |
Records the corresponding module checksums. |
nix/package.nix |
Updates the Nix vendor hash. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
govulncheck reports eleven advisories that the CLI reaches in the Go 1.26.7 standard library (net/http, net/textproto, crypto/tls and html/template), all fixed in Go 1.26.9: GO-2026-6617, 6613, 6612, 6611, 6610, 6608, 6607, 6605, 6603, 6600 and 6599. This is a toolchain line, not a higher go line. setup-go reads the toolchain directive, so every CI and release job builds and scans with 1.26.9, and a local go older than that switches to it. The go line stays the minimum that builds the module: nixpkgs-unstable has only Go 1.26.8, and the flake builds with GOTOOLCHAIN=local, so go 1.26.9 there would fail the required Nix flake build until nixpkgs catches up.
Finding
golang.org/x/netv0.59.0 carries five advisories, all fixed in v0.60.0:govulncheck finds the CLI calling the affected code (for example through
internal/connector/driver/worker.go:339andinternal/connector/setup/checks.go:456). Trivy fails Trivy Security Scan on the HIGH one. Both checks went red onmainwithout a code change, when the advisory database picked these up.Fix
golang.org/x/netv0.59.0 → v0.60.0.go mod tidymoved nothing else.nix/package.nix: a newvendorHashfor the newgo.sum.make update-nix-hashrecomputed it and verified the flake builds in Docker.Proof
fs --severity HIGH,CRITICAL --ignore-unfixed:mainhas 1 HIGH finding (golang.org/x/netCVE-2026-78669). This branch has 0.govulncheck -tags dev ./...under Go 1.26.7: onmain, GO-2026-6617, 6612, 6611, 6610 and 6603 are found ingolang.org/x/net@v0.59.0. On this branch, x/net is no longer listed.bin/cipasses locally.Not fixed here: the required Security check stays red
The same govulncheck run also reports 11 Go standard library advisories in Go 1.26.7, fixed in Go 1.26.9. So Security stays red on this PR until the Go toolchain moves. That fix is #881 ("Build with Go 1.26.9 for eleven standard-library advisories"), stacked on this one. The two have to reach
maintogether.Merge order: merge #881 into this branch first. This PR then holds both commits and goes green. Then rebase-merge this PR into
main.