unboundsoftware/default-request-adder
6
0 Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases 34 Activity

fix(deps): bump golang.org/x/net to v0.61.0 [security] #414

Merged
argoyle merged 1 commits from fix/x-net-vulns into main 2026-10-14 09:13:12 +00:00
Conversation 0 Commits 1 Files Changed 2
+12 -12
argoyle commented 2026-10-14 07:15:36 +00:00
Owner
Copy link
Copy source

Bumps golang.org/x/net from v0.57.0 to v0.61.0 to fix five HTTP/2 vulnerabilities that govulncheck reports as reachable through client-go:

  • GO-2026-6603: HTTP/2 server memory exhaustion due to Trailer headers
  • GO-2026-6610: HTTP/2 transport accepts malformed framing-related headers
  • GO-2026-6611: Excessive CPU consumption from repeated initial window changes
  • GO-2026-6612: Double flow control refund on HTTP/2 server streams
  • GO-2026-6617: HTTP/2 server crash due to HPACK encoder race

go get also brought in newer x/sys, x/term and x/text.

Verified locally: govulncheck ./... reports no vulnerabilities, and go test -race ./... passes (the repo has no test files).

🤖 Generated with Claude Code

https://claude.ai/code/session_01MFgbwhfAnf8tMbeKRab9AD

Bumps `golang.org/x/net` from v0.57.0 to v0.61.0 to fix five HTTP/2 vulnerabilities that govulncheck reports as reachable through client-go: - GO-2026-6603: HTTP/2 server memory exhaustion due to Trailer headers - GO-2026-6610: HTTP/2 transport accepts malformed framing-related headers - GO-2026-6611: Excessive CPU consumption from repeated initial window changes - GO-2026-6612: Double flow control refund on HTTP/2 server streams - GO-2026-6617: HTTP/2 server crash due to HPACK encoder race `go get` also brought in newer `x/sys`, `x/term` and `x/text`. Verified locally: `govulncheck ./...` reports no vulnerabilities, and `go test -race ./...` passes (the repo has no test files). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01MFgbwhfAnf8tMbeKRab9AD
argoyle added 1 commit 2026-10-14 07:15:37 +00:00
fix(deps): bump golang.org/x/net to v0.61.0 [security]
default-request-adder / test (pull_request) Successful in 44s
Details
default-request-adder / vulnerabilities (pull_request) Successful in 31s
Details
default-request-adder / build (pull_request) Successful in 53s
Details
0c14897f83 
Fixes GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617
(HTTP/2 issues reachable via client-go). Also bumps x/sys, x/term and x/text.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MFgbwhfAnf8tMbeKRab9AD
argoyle scheduled this pull request to auto merge when all checks succeed 2026-10-14 07:18:16 +00:00
argoyle merged commit 20e8dbdbb8 into main 2026-10-14 09:13:12 +00:00
argoyle deleted branch fix/x-net-vulns 2026-10-14 09:13:12 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 docker
go
security
Pull requests that address a security vulnerability
 severity:moderate
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
acctest (Shiny Acctest) argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) peter (Peter Svensson) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unboundsoftware/default-request-adder#414