fix(deps): bump x/text to v0.39.0 to clear GO-2026-5970 - #302
Merged
Conversation
CI on main fails at the "Go - Lint" job, which runs `make audit` and so includes govulncheck. The failure is not caused by a code change. Run #300 (2026-07-18) passed and run #301 (2026-07-25) failed, but the merge in between never touched go.mod or go.sum, and golang.org/x/text was v0.37.0 on both sides. The advisory was published in the interval, so the build broke on a timer rather than on a commit. GO-2026-5970 is an infinite loop on invalid input in golang.org/x/text. It is called rather than merely present, reached through recovery.sendShardsToKeepers -> net.Post -> norm.Form.*, so govulncheck exits non-zero and takes the job with it. Bumps x/text v0.37.0 -> v0.39.0, which fixes it, and x/net v0.55.0 -> v0.56.0 to clear the uncalled GO-2026-5942 in the same pass. `go mod tidy` transitively lifts x/crypto to v0.53.0, x/sys to v0.46.0, and x/term to v0.44.0. No application code changes. One finding is deliberately left behind. GO-2026-5932 reports that golang.org/x/crypto/openpgp is unmaintained and unsafe by design, with no fixed version: the package is deprecated, not patched, so no bump can clear it. It arrives transitively and SPIKE does not call it, so govulncheck exits 0 with it present. That makes Round 1's "zero vulnerabilities total, not merely zero called" criterion unreachable, so the spec amends it rather than silently missing it. The standing bar is now zero *called* vulnerabilities plus a recorded justification for every uncalled one left in place, with clearing uncalled findings still preferred wherever a fixed version exists. Verified with the same command CI runs: `make audit` exits 0, `make test` passes on the upgraded graph, and `go build ./...` is clean. Spec: specs/vuln-remediation.md Signed-off-by: Volkan Özçelik <volkan.ozcelik@broadcom.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI on main fails at the "Go - Lint" job, which runs
make auditand so includes govulncheck. The failure is not caused by a code change. Run #300 (2026-07-18) passed and run #301 (2026-07-25) failed, but the merge in between never touched go.mod or go.sum, and golang.org/x/text was v0.37.0 on both sides. The advisory was published in the interval, so the build broke on a timer rather than on a commit.GO-2026-5970 is an infinite loop on invalid input in golang.org/x/text. It is called rather than merely present, reached through recovery.sendShardsToKeepers -> net.Post -> norm.Form.*, so govulncheck exits non-zero and takes the job with it.
Bumps x/text v0.37.0 -> v0.39.0, which fixes it, and x/net v0.55.0 -> v0.56.0 to clear the uncalled GO-2026-5942 in the same pass.
go mod tidytransitively lifts x/crypto to v0.53.0, x/sys to v0.46.0, and x/term to v0.44.0. No application code changes.One finding is deliberately left behind. GO-2026-5932 reports that golang.org/x/crypto/openpgp is unmaintained and unsafe by design, with no fixed version: the package is deprecated, not patched, so no bump can clear it. It arrives transitively and SPIKE does not call it, so govulncheck exits 0 with it present.
That makes Round 1's "zero vulnerabilities total, not merely zero called" criterion unreachable, so the spec amends it rather than silently missing it. The standing bar is now zero called vulnerabilities plus a recorded justification for every uncalled one left in place, with clearing uncalled findings still preferred wherever a fixed version exists.
Verified with the same command CI runs:
make auditexits 0,make testpasses on the upgraded graph, andgo build ./...is clean.Spec: specs/vuln-remediation.md