unboundsoftware/default-request-adder
6
0 Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases 34 Activity

fix(deps): bump golang.org/x/net to v0.61.0 [security] (#414)
default-request-adder / test (push) Successful in 29s
Details
default-request-adder / vulnerabilities (push) Successful in 31s
Details
Unbound Release / Check Preconditions (push) Successful in 1s
Details
Unbound Release / Create Tag (push) Skipped
Details
Unbound Release / Generate Changelog and Handle PR (push) Successful in 9s
Details
Unbound Release / Create Release (push) Successful in 11s
Details
Release / release (push) Successful in 26s
Details
default-request-adder / build (push) Successful in 19m41s
Details

Browse Source 
Bumps `golang.org/x/net` from v0.57.0 to v0.61.0 to fix five HTTP/2 vulnerabilities that govulncheck reports as reachable through client-go:

- GO-2026-6603: HTTP/2 server memory exhaustion due to Trailer headers
- GO-2026-6610: HTTP/2 transport accepts malformed framing-related headers
- GO-2026-6611: Excessive CPU consumption from repeated initial window changes
- GO-2026-6612: Double flow control refund on HTTP/2 server streams
- GO-2026-6617: HTTP/2 server crash due to HPACK encoder race

`go get` also brought in newer `x/sys`, `x/term` and `x/text`.

Verified locally: `govulncheck ./...` reports no vulnerabilities, and `go test -race ./...` passes (the repo has no test files).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01MFgbwhfAnf8tMbeKRab9AD
Reviewed-on: https://gitea.unbound.se/unboundsoftware/default-request-adder/pulls/414
This commit was merged in pull request #414.
This commit is contained in:
argoyle committed 2026-10-14 09:13:11 +00:00
1 parent 095aa6752f
commit 20e8dbdbb8
2 files changed
+12 -12
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

go.sum
+8 -8
View File
@@ -82,16 +82,16 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=