From e3d4c5cdc9db3a6aca99eefcfb110a59d26afa71 Mon Sep 17 00:00:00 2001 From: Dmitrii Creed Date: Sun, 24 May 2026 18:25:14 +0400 Subject: [PATCH] =?UTF-8?q?deps:=20bump=20golang.org/x/net=20v0.54.0=20?= =?UTF-8?q?=E2=86=92=20v0.55.0=20to=20fix=206=20Scorecard=20vulns?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes 6 of 8 OpenSSF Scorecard Vulnerabilities-probe warnings (`osv-scanner` against the full module tree, no reachability): GO-2026-5025 net/html — namespaced elements in foreign content GO-2026-5026 net/idna — Punycode → ASCII-only label accepted GO-2026-5027 net/html — HTML elements in foreign content (XSS) GO-2026-5028 net/html — CPU DoS on arbitrary HTML GO-2026-5029 net/html — character refs in DOCTYPE nodes GO-2026-5030 net/html — duplicate attributes → XSS All six are fixed in golang.org/x/net v0.55.0 (released 2026-05-22). OSV reports zero advisories against v0.55.0. Remaining 2 warnings — GO-2022-0635 / GO-2022-0646 (aws-sdk-go v1 s3crypto, CVE-2020-8911/8912) — have NO fix in the v1 line; the AWS SDK Go team only patched s3crypto in v2. Both `github.com/pulumi/pulumi/pkg/v3@latest` and `gocloud.dev@latest` still pull aws-sdk-go v1 transitively, so we can't drop it without dropping Pulumi or gocloud.dev. Both advisories are already documented as `not_affected` / `vulnerable_code_not_in_execute_path` in vex/openvex.json and govulncheck reachability confirms 0 calls into the s3crypto subpackage. Scorecard's `hasOSVVulnerabilities` probe does not consume OpenVEX, so the warnings will persist until upstream migrates off aws-sdk-go v1. Signed-off-by: Dmitrii Creed --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 842a6530..ef9a3696 100644 --- a/go.mod +++ b/go.mod @@ -470,7 +470,7 @@ require ( golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect golang.org/x/mod v0.35.0 // indirect - golang.org/x/net v0.54.0 // indirect + golang.org/x/net v0.55.0 // indirect golang.org/x/sys v0.45.0 // indirect golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa // indirect golang.org/x/time v0.15.0 // indirect diff --git a/go.sum b/go.sum index 22b844c4..f4cb87f6 100644 --- a/go.sum +++ b/go.sum @@ -1168,8 +1168,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY= -golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w= -golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ= +golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= +golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=