From 41fa5ee1e792f1177b23dd6b8206e6ff3108a06e Mon Sep 17 00:00:00 2001 From: Nitin Punn Date: Sat, 8 Aug 2026 04:43:12 -0400 Subject: [PATCH] security: bump golang.org/x/net to v0.57.0 and klauspost/compress to v1.18.7 Closes GHSA-5cv4-jp36-h3mw (CVE-2026-25680, medium) on golang.org/x/net, plus 23 further advisories that Dependabot did not raise. golang.org/x/net v0.49.0 -> v0.57.0. Dependabot's floor of 0.55.0 is not sufficient: GO-2026-5942 (CVE-2026-46600, dns/dnsmessage) is fixed only in 0.56.0 and has no GHSA record, so it generates no alert. v0.57.0 is the latest stable release and clears all 8 x/net advisories. It also lifts x/crypto v0.47.0 -> v0.54.0 (13 advisories, 7 critical), x/sys v0.40.0 -> v0.47.0 and x/text v0.34.0 -> v0.40.0 in the resolved graph. github.com/klauspost/compress v1.18.0 -> v1.18.7 closes GO-2026-5841 (OOB read in compress/s2), the only baseline finding whose affected package is actually compiled here. v1.18.7 is a security-only release; v1.19.x was deliberately not taken because it adds new arm64 assembly to the zstd and huff0 decode paths that this repository has no test coverage for. The go directive moves 1.24.0 -> 1.25.0. This is forced, not chosen: every release that fixes these advisories declares go 1.25.0, and "go mod tidy -go=1.24.0" fails. Crossing into 1.25 flips five GODEBUG defaults (containermaxprocs, updatemaxprocs, decoratemappings, tlssha1, x509sha256skid) for any module whose own go directive reaches 1.25. No application-code changes. go build, go vet, go test, go test -race, go mod verify, go mod tidy -diff and gofmt all pass locally. --- go.mod | 7 +++---- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/go.mod b/go.mod index 8fb5137..ae6c738 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/attentiontech/walstream-go -go 1.24.0 +go 1.25.0 require ( github.com/segmentio/kafka-go v0.4.50 @@ -9,10 +9,9 @@ require ( require ( github.com/davecgh/go-spew v1.1.1 // indirect - github.com/klauspost/compress v1.18.0 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/pierrec/lz4/v4 v4.1.15 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect - golang.org/x/net v0.49.0 // indirect - golang.org/x/text v0.34.0 // indirect + golang.org/x/net v0.57.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index b5d324d..da4c849 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= -github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0= github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -16,10 +16,10 @@ github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY= github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4= github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8= github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM= -golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= -golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= -golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= -golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=