Skip to content

Commit ff00ebf

Browse files
ValClarksoncursoragent
ValClarkson
and
cursoragent
committed
chore(deps): bump x/net 0.54.0 -> 0.55.0 and x/crypto 0.51.0 -> 0.52.0
Backport of the same fix opened against main in #4496. Fixes the govulncheck failure that is currently red on REL_5_8. The blocking finding is a Symbol-level vulnerability in our test helpers: Vulnerability #1: GO-2026-5026 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna Module: golang.org/x/net Found in: golang.org/x/net@v0.54.0 Fixed in: golang.org/x/net@v0.55.0 Example traces found: #1: internal/testing/require/kubernetes.go: require.KubernetesAtLeast calls discovery.DiscoveryClient.ServerVersion, which eventually calls idna.ToASCII The same scan also reports 18 module-level (uncalled) vulnerabilities, which this bump clears as a side-effect: * 5 more golang.org/x/net/html vulns: GO-2026-5025/5027/5028/5029/5030 (fixed in x/net v0.55.0) * 13 golang.org/x/crypto/ssh* vulns: GO-2026-5005/5006/5013/5014/5015/5016/5017/5018/5019/5020/ GO-2026-5021/5023/5033 (fixed in x/crypto v0.52.0) Compatibility check: * k8s.io/api, k8s.io/apimachinery, k8s.io/client-go @ v0.36.1 each require x/net >= v0.49.0 (we go to v0.55.0) * sigs.k8s.io/controller-runtime @ v0.24.1 requires x/net >= v0.49.0 (we go to v0.55.0) Both bumps are minor patch releases on the golang.org/x/* track, with no breaking changes. 'go mod tidy' additionally bumped x/sys v0.44.0 -> v0.45.0 to satisfy the new x/crypto/x/net requirement. Refs: https://pkg.go.dev/vuln/GO-2026-5026 https://pkg.go.dev/vuln/GO-2026-5005 https://pkg.go.dev/vuln/GO-2026-5023 Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 8d483b1 commit ff00ebf

2 files changed

Lines changed: 9 additions & 9 deletions

File tree

‎go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ require (
1919
go.opentelemetry.io/otel v1.43.0
2020
go.opentelemetry.io/otel/sdk v1.43.0
2121
go.opentelemetry.io/otel/trace v1.43.0
22-
golang.org/x/crypto v0.51.0
22+
golang.org/x/crypto v0.52.0
2323
golang.org/x/tools v0.45.0
2424
gotest.tools/v3 v3.5.2
2525
k8s.io/api v0.36.1
@@ -102,10 +102,10 @@ require (
102102
go.yaml.in/yaml/v3 v3.0.4 // indirect
103103
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
104104
golang.org/x/mod v0.36.0 // indirect
105-
golang.org/x/net v0.54.0 // indirect
105+
golang.org/x/net v0.55.0 // indirect
106106
golang.org/x/oauth2 v0.35.0 // indirect
107107
golang.org/x/sync v0.20.0 // indirect
108-
golang.org/x/sys v0.44.0 // indirect
108+
golang.org/x/sys v0.45.0 // indirect
109109
golang.org/x/term v0.43.0 // indirect
110110
golang.org/x/text v0.37.0 // indirect
111111
golang.org/x/time v0.14.0 // indirect

‎go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -235,8 +235,8 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
235235
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
236236
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
237237
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
238-
golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
239-
golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
238+
golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
239+
golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
240240
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
241241
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
242242
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -245,8 +245,8 @@ golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
245245
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
246246
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
247247
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
248-
golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
249-
golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
248+
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
249+
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
250250
golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
251251
golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
252252
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -258,8 +258,8 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
258258
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
259259
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
260260
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
261-
golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
262-
golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
261+
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
262+
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
263263
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
264264
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
265265
golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=

0 commit comments

Comments
 (0)