Skip to content

fix(deps): vuln minor upgrades — 4 packages (minor: 4) #52

Draft
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/0-1783348164
Draft

fix(deps): vuln minor upgrades — 4 packages (minor: 4) #52
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/0-1783348164

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Jul 6, 2026

Copy link
Copy Markdown

Summary: High-severity security update — 4 packages upgraded (MINOR changes included)

Manifests changed:

  • . (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
golang.org/x/net v0.7.0 v0.56.0 minor Transitive 6 HIGH, 15 MEDIUM, 7 UNKNOWN
golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2 v0.36.0 minor Transitive 2 HIGH
google.golang.org/protobuf v1.28.1 v1.36.11 minor Transitive 2 MEDIUM
golang.org/x/sys v0.6.0 v0.46.0 minor Transitive 1 UNKNOWN

Security Details

🚨 Critical & High Severity (8 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
golang.org/x/net GHSA-4374-p667-p6c8 HIGH HTTP/2 rapid reset can cause excessive work in net/http v0.7.0 0.17.0 -
golang.org/x/net CVE-2023-44487 high This package is related to CVE CVE-2023-44487 which was detected by cisa.gov as actively being exploited in the wild v0.7.0 - -
golang.org/x/net GHSA-w32m-9786-jp63 HIGH Non-linear parsing of case-insensitive content in golang.org/x/net/html v0.7.0 - -
golang.org/x/net GO-2024-3333 HIGH Non-linear parsing of case-insensitive content in golang.org/x/net/html v0.7.0 0.33.0 -
golang.org/x/net GO-2023-2102 HIGH HTTP/2 rapid reset can cause excessive work in net/http v0.7.0 0.17.0 -
golang.org/x/net CVE-2023-39325 HIGH - v0.7.0 - -
golang.org/x/oauth2 GO-2025-3488 HIGH Unexpected memory consumption during token parsing in golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2 0.27.0 -
golang.org/x/oauth2 GHSA-6v2p-p543-phr9 HIGH golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability v0.0.0-20220622183110-fd043fe589d2 0.27.0 -
ℹ️ Other Vulnerabilities (25)
Package CVE Severity Summary Unsafe Version Fixed In Case
golang.org/x/net CVE-2023-3978 medium - v0.7.0 - -
golang.org/x/net GO-2023-1988 medium Improper rendering of text nodes in golang.org/x/net/html v0.7.0 0.13.0 -
golang.org/x/net GHSA-vvgc-356p-c3xw MODERATE golang.org/x/net vulnerable to Cross-site Scripting v0.7.0 0.38.0 -
golang.org/x/net GHSA-5cv4-jp36-h3mw MODERATE Go Net HTML parser is vulnerable to denial of service v0.7.0 0.55.0 -
golang.org/x/net GHSA-2wrh-6pvc-2jm9 MODERATE Improper rendering of text nodes in golang.org/x/net/html v0.7.0 0.13.0 -
golang.org/x/net GO-2026-4440 MODERATE Quadratic parsing complexity in golang.org/x/net/html v0.7.0 0.45.0 -
golang.org/x/net GO-2026-5028 MODERATE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.7.0 0.55.0 -
golang.org/x/net GO-2025-3595 MODERATE Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net v0.7.0 0.38.0 -
golang.org/x/net GHSA-4v7x-pqxf-cx7m MODERATE net/http, x/net/http2: close connections when receiving too many headers v0.7.0 0.23.0 -
golang.org/x/net GO-2024-2687 MODERATE HTTP/2 CONTINUATION flood in net/http v0.7.0 0.23.0 -
golang.org/x/net GHSA-qxp5-gwg8-xv66 MODERATE HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net v0.7.0 0.36.0 -
golang.org/x/net GO-2025-3503 MODERATE HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net v0.7.0 0.36.0 -
golang.org/x/net GHSA-w4gw-w5jq-g9jh MODERATE golang.org/x/net/html has a Quadratic Parsing Complexity issue v0.7.0 - -
golang.org/x/net CVE-2023-44487 MODERATE - v0.7.0 - -
golang.org/x/net GHSA-qppj-fm5r-hxr3 MODERATE HTTP/2 Stream Cancellation Attack v0.7.0 0.17.0 -
google.golang.org/protobuf GO-2024-2611 MODERATE Infinite loop in JSON unmarshaling in google.golang.org/protobuf v1.28.1 1.33.0 -
google.golang.org/protobuf GHSA-8r3f-844c-mc37 MODERATE Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON v1.28.1 1.33.0 -
golang.org/x/net GO-2026-5029 unknown Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.7.0 0.55.0 -
golang.org/x/net GO-2026-5027 unknown Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.7.0 0.55.0 -
golang.org/x/net GO-2026-5025 unknown Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.7.0 0.55.0 -
golang.org/x/net GO-2026-4441 unknown Infinite parsing loop in golang.org/x/net v0.7.0 0.45.0 -
golang.org/x/net GO-2026-5030 unknown Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.7.0 0.55.0 -
golang.org/x/net GO-2026-5026 unknown Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.7.0 0.55.0 -
golang.org/x/net GO-2026-4918 unknown Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.7.0 0.53.0 -
golang.org/x/sys GO-2026-5024 unknown Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows v0.6.0 0.44.0 -
⚠️ Dependencies that have Reached EOL (4)
Dependency Unsafe Version EOL Date New Version Path
golang.org/x/net v0.7.0 Feb 14, 2026 v0.56.0 go.mod
golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2 Jun 22, 2025 v0.36.0 go.mod
golang.org/x/sys v0.6.0 Mar 4, 2026 v0.46.0 go.mod
google.golang.org/protobuf v1.28.1 Jul 28, 2025 v1.36.11 go.mod

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-dependency-update adms-fixes-eol adms-go adms-high-severity adms-medium-severity adms-minor-update adms-mode-all-vulns campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants