Skip to content

fix(deps): bump golang.org/x/net to v0.62.0 (CVE-2026-78661, CVE-2026-97045) - #44

Open
kycheng wants to merge 1 commit into
alauda-v4.47.1from
fix/vuln-x-net-go-jose-alauda-v4.47.1
Open

kycheng wants to merge 1 commit into
alauda-v4.47.1from
fix/vuln-x-net-go-jose-alauda-v4.47.1

Conversation

@kycheng

@kycheng kycheng commented Nov 5, 2026

Copy link
Copy Markdown
Collaborator

Bumps golang.org/x/net v0.60.0 -> v0.62.0 (x/text v0.43.0 and x/sys v0.49.0 follow). go-jose, go-chi and x/crypto are not used by the yq binary, so they are untouched. go/toolchain directives unchanged (1.27.2 / 1.27.3).

Verified: go build ., go version -m shows x/net v0.62.0, go test ./pkg/yqlib/... passes.

🤖 Generated with Claude Code

Bump golang.org/x/net v0.60.0 -> v0.62.0. golang.org/x/text (v0.42.0 ->
v0.43.0) and golang.org/x/sys (v0.48.0 -> v0.49.0) move along as required
by x/net. go-jose and go-chi are not in this module's dependency graph.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants