Skip to content

fix(deps): bump x/net and x/crypto to fix CVE-2026-78661, CVE-2026-97045, GO-2026-5932 - #57

Open
kycheng wants to merge 1 commit into
alauda-v1.33.7from
fix/vuln-x-net-go-jose-1.33.7
Open

kycheng wants to merge 1 commit into
alauda-v1.33.7from
fix/vuln-x-net-go-jose-1.33.7

Conversation

@kycheng

@kycheng kycheng commented Nov 5, 2026

Copy link
Copy Markdown
Collaborator

Bumps on the 1.33.7 line (kubectl for GitLab 18.8):

  • golang.org/x/net v0.60.0 -> v0.62.0 (CVE-2026-78661, CVE-2026-97045)
  • golang.org/x/crypto v0.57.0 -> v0.58.1-0.20261009181718-2f1f834330b2 (GO-2026-5932)
  • forced minimums: x/text v0.43.0, x/sys v0.49.0, x/term v0.47.0, x/sync v0.24.0, x/tools v0.51.0

go-jose v4 and go-chi are not in this dependency graph (only gopkg.in/go-jose/go-jose.v2 v2.6.3), so they are untouched. Go directive unchanged (1.27.3). Root and staging go.mod/go.sum updated via go work sync, vendor via go work vendor.

Verified: go build ./cmd/kubectl OK; go version -m shows x/net v0.62.0; kubectl pkg/cmd/get and version tests pass. x/crypto is vendored but not linked into the kubectl binary.

🤖 Generated with Claude Code

, GO-2026-5932

Bump golang.org/x/net v0.60.0 -> v0.62.0 and golang.org/x/crypto v0.57.0 ->
v0.58.1-0.20261009181718-2f1f834330b2 across the root and staging modules,
re-vendored. Required minimums pulled in: x/text v0.43.0, x/sys v0.49.0,
x/term v0.47.0, x/sync v0.24.0, x/tools v0.51.0.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant