Repository navigation
Commit 41e4acb
authored
🤖 fix: bump Go to 1.26.9 and golang.org/x/net to v0.60.0 (#222)
Fixes #221
## Summary
Bump the Go toolchain from 1.26.8 to 1.26.9 and `golang.org/x/net` from
v0.58.0 to v0.60.0. This clears the 12 called vulnerabilities that make
`go tool govulncheck ./...` (the last step of the required `lint` job)
fail, and the HIGH findings that fail the Trivy filesystem and image
scans.
## Background
Since the vulnerability database update after 2026-10-03, every new CI
run fails `lint`, `Trivy filesystem scan` and `Trivy image scan`, so no
PR can merge (#163 included).
Advisories fixed (all were reported as called by coder-k8s code):
| Advisory | CVE | Package | Summary |
| --- | --- | --- | --- |
| GO-2026-6599 | CVE-2026-94448 | stdlib | html/template: context
tracking on consecutive template expressions |
| GO-2026-6600 | CVE-2026-97030 | stdlib | html/template: `yield` as
regexp preceder keyword |
| GO-2026-6603 | CVE-2026-78659 | stdlib, x/net | HTTP/2 server memory
exhaustion via Trailer headers |
| GO-2026-6605 | CVE-2026-56866 | stdlib | HTTP/1 client desync after
CONNECT rejection |
| GO-2026-6607 | CVE-2026-97031 | stdlib | crypto/tls: malformed ECH
outer extension references |
| GO-2026-6608 | CVE-2026-94440 | stdlib | net/textproto,
mime/multipart: MIME header memory limit bypass |
| GO-2026-6609 | CVE-2026-78667 | stdlib | net/http: no limit on parsed
Range header size |
| GO-2026-6610 | CVE-2026-78660 | stdlib, x/net | HTTP/2 transport
accepts malformed framing headers |
| GO-2026-6611 | CVE-2026-78669 | stdlib, x/net | HTTP/2 CPU use from
repeated initial window changes |
| GO-2026-6612 | CVE-2026-78663 | stdlib, x/net | HTTP/2 server double
flow-control refund |
| GO-2026-6613 | CVE-2026-94439 | stdlib | HTTP/1 server desync after
2xx CONNECT response |
| GO-2026-6617 | CVE-2026-97032 | stdlib, x/net | HTTP/2 server crash
from HPACK encoder race |
## Implementation
- `go.mod`: `go 1.26.9`. CI, CodeQL and release read the toolchain
through `setup-go` `go-version-file: go.mod`, so no workflow change is
needed. `Dockerfile.goreleaser` copies a prebuilt binary into distroless
and pins no Go version. `flake.nix` uses the unpinned nixpkgs `go` and
is not used by CI, so I left it and `flake.lock` unchanged.
- `go get golang.org/x/net@v0.60.0`, then `go mod tidy && go mod
vendor`. Minimal version selection also raised the x/net requirements:
`x/crypto` v0.57.0, `x/mod` v0.41.0, `x/sync` v0.23.0, `x/sys` v0.48.0,
`x/term` v0.46.0, `x/text` v0.42.0. `vendor/` is regenerated, not
hand-edited.
- README badge, AGENTS.md and CONTRIBUTING.md now say 1.26.9.
## Validation
- `GOFLAGS=-mod=vendor go tool govulncheck ./...` (the exact CI command,
govulncheck v1.1.4 built and run with go1.26.9, DB updated 2026-10-08):
before, 12 called vulnerabilities on go1.26.8 (the list above). After:
`Your code is affected by 0 vulnerabilities`, exit 0. The one remaining
module-level entry is GO-2026-5932 (unmaintained `x/crypto/openpgp`, not
called, no fix exists).
- Trivy v0.74.0 (the CI version), HIGH/CRITICAL, exit code 1 on
findings: `fs --skip-dirs vendor` on a `git archive` of the head reports
0 for `go.mod`. A `CGO_ENABLED=0` go1.26.9 build of the binary reports 0
for the `gobinary` target.
- `make verify-vendor`, `make build`, `make lint`, `make test`, `make
test-integration`, `make docs-check` pass locally. `make vuln` fails on
my host only because its PATH `govulncheck` was built with go1.25
("package requires newer Go version go1.26"); CI does not use that
binary.
## Risks
Low. This is a patch-level toolchain bump plus patch/minor bumps of
`golang.org/x` modules. No coder-k8s code changes. The full Kind E2E in
CI covers the runtime paths.
---
_Generated with `mux` • Model: `anthropic:claude-opus-5-5` • Thinking:
`high`_
<!-- mux-attribution: model=anthropic:claude-opus-5-5 thinking=high -->
Signed-off-by: Thomas Kosiewski <tk@coder.com>1 parent 55e7f34 commit 41e4acb
79 files changed
Lines changed: 3491 additions & 2226 deletions
File tree
- vendor
- golang.org/x
- mod/modfile
- net
- html
- http2
- internal/httpcommon
- trace
- sync/semaphore
- sys
- cpu
- unix
- windows
- term
- text/unicode
- bidi
- norm
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
8 | | - | |
| 8 | + | |
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
7 | 7 | | |
8 | 8 | | |
9 | 9 | | |
10 | | - | |
| 10 | + | |
11 | 11 | | |
12 | 12 | | |
13 | 13 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | 3 | | |
4 | | - | |
| 4 | + | |
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | | - | |
| 3 | + | |
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
| |||
395 | 395 | | |
396 | 396 | | |
397 | 397 | | |
398 | | - | |
| 398 | + | |
399 | 399 | | |
400 | 400 | | |
401 | | - | |
402 | | - | |
| 401 | + | |
| 402 | + | |
403 | 403 | | |
404 | | - | |
405 | | - | |
| 404 | + | |
| 405 | + | |
406 | 406 | | |
407 | | - | |
408 | | - | |
| 407 | + | |
| 408 | + | |
409 | 409 | | |
410 | 410 | | |
411 | 411 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1007 | 1007 | | |
1008 | 1008 | | |
1009 | 1009 | | |
1010 | | - | |
1011 | | - | |
| 1010 | + | |
| 1011 | + | |
1012 | 1012 | | |
1013 | 1013 | | |
1014 | 1014 | | |
| |||
1024 | 1024 | | |
1025 | 1025 | | |
1026 | 1026 | | |
1027 | | - | |
1028 | | - | |
| 1027 | + | |
| 1028 | + | |
1029 | 1029 | | |
1030 | 1030 | | |
1031 | 1031 | | |
| |||
1041 | 1041 | | |
1042 | 1042 | | |
1043 | 1043 | | |
1044 | | - | |
1045 | | - | |
| 1044 | + | |
| 1045 | + | |
1046 | 1046 | | |
1047 | 1047 | | |
1048 | 1048 | | |
| |||
1055 | 1055 | | |
1056 | 1056 | | |
1057 | 1057 | | |
1058 | | - | |
1059 | | - | |
| 1058 | + | |
| 1059 | + | |
1060 | 1060 | | |
1061 | 1061 | | |
1062 | 1062 | | |
| |||
1087 | 1087 | | |
1088 | 1088 | | |
1089 | 1089 | | |
1090 | | - | |
1091 | | - | |
| 1090 | + | |
| 1091 | + | |
1092 | 1092 | | |
1093 | 1093 | | |
1094 | 1094 | | |
| |||
1099 | 1099 | | |
1100 | 1100 | | |
1101 | 1101 | | |
1102 | | - | |
1103 | | - | |
| 1102 | + | |
| 1103 | + | |
1104 | 1104 | | |
1105 | 1105 | | |
1106 | 1106 | | |
| |||
1112 | 1112 | | |
1113 | 1113 | | |
1114 | 1114 | | |
1115 | | - | |
1116 | | - | |
| 1115 | + | |
| 1116 | + | |
1117 | 1117 | | |
1118 | 1118 | | |
1119 | 1119 | | |
| |||
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments