deps: bump vulnerable Go dependencies - #1351
Open
bigbes wants to merge 2 commits into
Open
Conversation
The commit message spell check has no way to accept a security advisory identifier: cspell splits GHSA-hrxh-6v49-42gf into words and reports the random segments as unknown. That makes a dependency bump choose between naming the advisories it closes and a green check-commit-msg. Ignore both identifier shapes by regexp instead of adding their segments to the project dictionary, where they would be meaningless words. Add the two tool and project names that a security bump also needs: govulncheck and moby. Part of TNTP-3131
bigbes
force-pushed
the
bigbes/tntp-3131-security-deps-bump
branch
from
September 1, 2026 06:51
906283e to
b72552d
Compare
Update the Go modules flagged by Dependabot and govulncheck across the root module, lib/cluster, lib/connect, lib/dial and the aeon test server. - Bump golang.org/x/crypto 0.49.0/0.51.0 -> 0.55.0, which closes twelve advisories, seven of them critical, and GO-2026-6303 in the ssh package. - Bump golang.org/x/net 0.52.0/0.53.0 -> 0.57.0 (GHSA-5cv4-jp36-h3mw). - Bump golang.org/x/text 0.35.0/0.37.0 -> 0.41.0. - Bump google.golang.org/grpc 1.79.3 -> 1.82.1 (GHSA-hrxh-6v49-42gf). - Bump go.opentelemetry.io/otel with its sdk and exporters from 1.34.0..1.42.0 to 1.44.0 (GHSA-mh2q-q3fh-2475, GHSA-hfvc-g4fc-pqhx, GHSA-w8rr-5gcm-pp58, GHSA-9h8m-3fm2-qjrq, GO-2026-5158). - Bump github.com/klauspost/compress 1.18.6 -> 1.18.7 (GO-2026-5841). - Bump the go.etcd.io/etcd modules 3.6.8 -> 3.6.14 (GO-2026-6107). - Let golang.org/x/sys, x/term, x/sync and spf13/pflag follow along to keep the module set consistent. github.com/docker/docker stays at v28.5.2+incompatible. Its advisories are fixed in Docker 29, which is published under the new module path github.com/moby/moby/v2 and has no stable release yet, so there is no version to bump to. The dependency is only reachable through the vendored cartridge-cli, which still imports github.com/docker/docker while cli/docker already uses github.com/moby/moby/client. After the bump govulncheck reports no vulnerability with a published fix left. The remaining findings are the docker ones above and GO-2026-5932 in golang.org/x/crypto, all marked "Fixed in: N/A". Part of TNTP-3131
bigbes
force-pushed
the
bigbes/tntp-3131-security-deps-bump
branch
from
September 1, 2026 07:08
b72552d to
80e45f2
Compare
sssciel
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update the Go modules flagged by Dependabot and govulncheck across the root module,
lib/cluster,lib/connect,lib/dialand the aeon test server.golang.org/x/cryptogolang.org/x/netgolang.org/x/textgoogle.golang.org/grpcgo.opentelemetry.io/otel+ sdk/exportersgithub.com/klauspost/compressgo.etcd.io/etcd/*golang.org/x/sys,x/term,x/syncandspf13/pflagfollow along to keep the module set consistent.Advisories closed: 12 for
x/crypto(7 critical), GHSA-5cv4-jp36-h3mw, GHSA-hrxh-6v49-42gf, GHSA-mh2q-q3fh-2475, GHSA-hfvc-g4fc-pqhx, GHSA-w8rr-5gcm-pp58, GHSA-9h8m-3fm2-qjrq, GO-2026-5158, GO-2026-5841, GO-2026-6303, GO-2026-6107.Spell check for advisory IDs
The first commit teaches cspell about security advisory identifiers. cspell splits
GHSA-hrxh-6v49-42gfinto words and reports the random segments as unknown, socheck-commit-msgforced a choice between naming the advisories a bump closes and a green CI. Both identifier shapes are now ignored by regexp rather than by pushing meaningless segments into the project dictionary;govulncheckandmobyare added as real vocabulary.Not fixed here
github.com/docker/dockerstays atv28.5.2+incompatible. Its advisories are fixed in Docker 29, which is published under the new module pathgithub.com/moby/moby/v2and has no stable release yet (v2.0.0-beta.21at the time of writing), so there is no version to bump to. The dependency is only reachable through the vendored cartridge-cli, which still importsgithub.com/docker/dockerwhilecli/dockeralready usesgithub.com/moby/moby/client— migrating it is a separate change.GO-2026-5932ingolang.org/x/cryptoisFixed in: N/A; we are already on the latest release.The pip advisories in
test/requirements.txt(pytest,requests,protobuf) are out of scope for this PR.Part of TNTP-3131