fix(deps): bump golang.org/x/net to v0.61.0 [security] (#414 )

Bumps `golang.org/x/net` from v0.57.0 to v0.61.0 to fix five HTTP/2 vulnerabilities that govulncheck reports as reachable through client-go: - GO-2026-6603: HTTP/2 server memory exhaustion due to Trailer headers - GO-2026-6610: HTTP/2 transport accepts malformed framing-related headers - GO-2026-6611: Excessive CPU consumption from repeated initial window changes - GO-2026-6612: Double flow control refund on HTTP/2 server streams - GO-2026-6617: HTTP/2 server crash due to HPACK encoder race `go get` also brought in newer `x/sys`, `x/term` and `x/text`. Verified locally: `govulncheck ./...` reports no vulnerabilities, and `go test -race ./...` passes (the repo has no test files). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01MFgbwhfAnf8tMbeKRab9AD Reviewed-on: https://gitea.unbound.se/unboundsoftware/default-request-adder/pulls/414
chore(deps): update golang:1.27.2 docker digest to 8201530 (#412 )
2026-10-14 09:13:11 +00:00 · 2026-10-14 02:26:41 +00:00 · 2026-10-13 09:25:08 +00:00 · 2026-10-09 01:11:34 +00:00 · 2026-10-08 20:41:55 +00:00 · 2026-10-06 17:05:51 +00:00
3 changed files with 14 additions and 14 deletions
@@ -1,4 +1,4 @@
-FROM golang:1.27.1@sha256:23fe8075c2e428136326703a2c63203f0c57595d8400eedbe06a29cab53055e8 AS deps
+FROM golang:1.27.2@sha256:820153096fda4de6ac1b7194d12e416b7dd8f4e9a33d17e0345b111b945162d8 AS deps
 WORKDIR /build
 ADD go.* /build
 RUN go mod download
@@ -2,7 +2,7 @@ module gitlab.com/unboundsoftware/default-request-adder

 go 1.26.0

-toolchain go1.27.1
+toolchain go1.27.2

 require (
 	k8s.io/api v0.37.1
@@ -38,11 +38,11 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/net v0.61.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/term v0.47.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
@@ -82,16 +82,16 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
Author	SHA1	Message	Date
argoyle	20e8dbdbb8	fix(deps): bump golang.org/x/net to v0.61.0 [security] (#414 ) default-request-adder / test (push) Successful in 29s Details default-request-adder / vulnerabilities (push) Successful in 31s Details Unbound Release / Check Preconditions (push) Successful in 1s Details Unbound Release / Create Tag (push) Skipped Details Unbound Release / Generate Changelog and Handle PR (push) Successful in 9s Details Unbound Release / Create Release (push) Successful in 11s Details Release / release (push) Successful in 26s Details default-request-adder / build (push) Successful in 19m41s Details Bumps `golang.org/x/net` from v0.57.0 to v0.61.0 to fix five HTTP/2 vulnerabilities that govulncheck reports as reachable through client-go: - GO-2026-6603: HTTP/2 server memory exhaustion due to Trailer headers - GO-2026-6610: HTTP/2 transport accepts malformed framing-related headers - GO-2026-6611: Excessive CPU consumption from repeated initial window changes - GO-2026-6612: Double flow control refund on HTTP/2 server streams - GO-2026-6617: HTTP/2 server crash due to HPACK encoder race `go get` also brought in newer `x/sys`, `x/term` and `x/text`. Verified locally: `govulncheck ./...` reports no vulnerabilities, and `go test -race ./...` passes (the repo has no test files). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01MFgbwhfAnf8tMbeKRab9AD Reviewed-on: https://gitea.unbound.se/unboundsoftware/default-request-adder/pulls/414	2026-10-14 09:13:11 +00:00
renovate	095aa6752f	chore(deps): update golang:1.27.2 docker digest to 8201530 (#412 ) Unbound Release / Check Preconditions (push) Successful in 3s Details default-request-adder / test (push) Successful in 40s Details Unbound Release / Create Tag (push) Skipped Details default-request-adder / vulnerabilities (push) Failing after 42s Details Release / release (push) Successful in 15s Details Unbound Release / Create Release (push) Successful in 5s Details Unbound Release / Generate Changelog and Handle PR (push) Successful in 11s Details default-request-adder / build (push) Successful in 1m6s Details	2026-10-14 02:26:41 +00:00
renovate	08ccd3d7bf	chore(deps): update golang:1.27.2 docker digest to 007a316 (#410 ) default-request-adder / test (push) Successful in 30s Details default-request-adder / vulnerabilities (push) Failing after 36s Details default-request-adder / build (push) Successful in 21m33s Details Unbound Release / Check Preconditions (push) Successful in 2s Details Unbound Release / Create Tag (push) Skipped Details Unbound Release / Generate Changelog and Handle PR (push) Successful in 10s Details Unbound Release / Create Release (push) Successful in 4s Details Release / release (push) Successful in 20m57s Details	2026-10-13 09:25:08 +00:00
renovate	acde212aed	chore(deps): update go toolchain directive to v1.27.2 [security] (#408 ) Unbound Release / Create Tag (push) Skipped Details Unbound Release / Check Preconditions (push) Successful in 7s Details default-request-adder / test (push) Successful in 59s Details Unbound Release / Create Release (push) Successful in 9s Details Release / release (push) Successful in 1m15s Details default-request-adder / vulnerabilities (push) Failing after 1m11s Details Unbound Release / Generate Changelog and Handle PR (push) Successful in 1m3s Details default-request-adder / build (push) Successful in 2m39s Details	2026-10-09 01:11:34 +00:00
renovate	8e1fd0d952	chore(deps): update golang docker tag to v1.27.2 (#406 ) default-request-adder / build (push) Successful in 8m0s Details Release / release (push) Successful in 12m54s Details Unbound Release / Generate Changelog and Handle PR (push) Successful in 1m3s Details Unbound Release / Create Release (push) Successful in 25s Details default-request-adder / test (push) Successful in 59s Details default-request-adder / vulnerabilities (push) Successful in 59s Details Unbound Release / Check Preconditions (push) Successful in 15s Details Unbound Release / Create Tag (push) Skipped Details	2026-10-08 20:41:55 +00:00
renovate	af5c4c7a35	chore(deps): update golang:1.27.1 docker digest to 1e93e00 (#404 ) Unbound Release / Check Preconditions (push) Successful in 24s Details Unbound Release / Create Tag (push) Skipped Details Unbound Release / Generate Changelog and Handle PR (push) Successful in 40s Details default-request-adder / vulnerabilities (push) Successful in 57s Details default-request-adder / test (push) Successful in 1m26s Details default-request-adder / build (push) Successful in 1m39s Details Unbound Release / Create Release (push) Successful in 1m3s Details Release / release (push) Successful in 1m43s Details	2026-10-06 17:05:51 +00:00