security: bump toolchain/x-net for CVEs and tighten CI gates by jeremy · Pull Request #483 · basecamp/basecamp-cli

jeremy · 2026-05-30T05:58:26Z

Bump toolchain/x-net for CVEs and tighten CI security gates

(Threat: T5 supply chain / toolchain CVEs.)

Toolchain + deps: toolchain go1.26.3 and golang.org/x/net v0.55.0. govulncheck ./... goes from 6 reachable advisories (x509 name-constraint bypass GO-2026-4866, TLS KeyUpdate DoS GO-2026-4870, x/net + net/http HTTP/2 loop GO-2026-4918, et al.) to "No vulnerabilities found."
gosec gate: the standalone gosec scan stays advisory (-no-fail, with full SARIF upload to the security tab) — it surfaces findings without failing the build. Enforcement of the gosec rule set is via golangci-lint (make lint), which honors the repo's //nolint:gosec suppressions (standalone gosec v2.25.0 does not — Nosec: 0) and deliberately treats G304 as a CLI false-positive; golangci-lint is the gate that hard-fails on any new gosec-class finding (weak crypto, SQLi, etc.).
gitleaks pinning: the release tarball is verified against a pinned SHA-256 before install.

sdk-provenance.json unchanged (the SDK itself didn't change).

Part 6/6 of the stacked security series. Base: `security/05-perms-and-exec-args`. Suggest landing last, since the gosec gate is the most likely to surface a follow-up.

📚 Stack (merge bottom-up)

security: reject foreign-host URLs in api to prevent token leak #478 — reject foreign-host URLs in api (base main)
security: strip ANSI/OSC escapes from API-controlled output #479 — strip ANSI/OSC escapes from output
security: harden OAuth discovery and token endpoints #480 — harden OAuth discovery / token endpoints
security: close config trust-boundary gaps and gate completion loader #481 — close config trust-boundary gaps + completion gate
security: tighten config-dir perms and validate plugin scope argv #482 — tighten config-dir perms + plugin scope argv
security: bump toolchain/x-net for CVEs and tighten CI gates #483 — bump toolchain/x-net + CI gates

Each is independent except #482 depends on #481 (shared root.go). #478 can land first/alone.

Summary by cubic

Updates the Go toolchain and golang.org/x/net to clear reachable CVEs; govulncheck now reports none. CI pins the gitleaks v8.21.2 tarball by SHA-256 before install and keeps the standalone gosec scan advisory-only with SARIF upload (enforced via golangci-lint).

Dependencies
- Add toolchain go1.26.3
- Bump golang.org/x/net to v0.55.0
- Bump golang.org/x/term to v0.43.0

^{Written for commit 5522054. Summary will update on new commits.}

github-actions · 2026-05-30T05:58:36Z

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

.github/workflows/security.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

cubic-dev-ai

No issues found across 3 files

_{Re-trigger cubic}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: feaed83814

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Pull request overview

This PR upgrades the Go toolchain/dependencies to address reported CVEs and strengthens the CI security workflow by making security scanners more tamper-resistant and stricter.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Changes:

Add toolchain go1.26.3 and bump golang.org/x/net (and related indirect sums) to newer patched versions.
Harden gitleaks installation in CI by verifying the downloaded release tarball against a pinned SHA-256.
Tighten the standalone gosec CI job by removing -no-fail and excluding the existing accepted baseline rule set.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
`go.mod`	Pins the Go toolchain and bumps indirect `x/net` / `x/term` versions.
`go.sum`	Updates module checksums to match the bumped indirect dependencies.
`.github/workflows/security.yml`	Hardens gitleaks install via checksum verification and turns gosec into a failing gate.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 54c2ef1b25

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-30T06:16:47Z

 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yuin/goldmark-emoji v1.0.6 // indirect
-	golang.org/x/net v0.48.0 // indirect
+	golang.org/x/net v0.55.0 // indirect


Update Nix vendor hash with dependency bump

Because this dependency bump changes the module graph, the fixed-output vendorHash in nix/package.nix also needs to be regenerated; it is still the pre-bump hash. In the contexts that build the flake (nix build, including the release workflow's nix-verify step), buildGoModule will reject the vendored dependency hash until scripts/update-nix-flake.sh/make update-nix-hash updates that value.

Useful? React with 👍 / 👎.

Flagged for human review — the vendorHash in nix/package.nix is indeed stale after the x/net + x/term bump and needs updating, but recomputing it requires a nix toolchain, which is not available in this environment. A maintainer with nix should run scripts/update-nix-flake.sh (or set vendorHash = lib.fakeHash and nix build, then paste the corrected hash). Leaving this thread open until then.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0cb36ba9a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-30T10:10:58Z


 go 1.26

+toolchain go1.26.3


Pin the Nix compiler to the patched Go toolchain

For Nix builds, this toolchain directive does not update the compiler selected by nix/package.nix: that derivation explicitly overrides buildGoModule with go_1_26, and the locked nixpkgs rev in flake.lock currently defines that package as Go 1.26.0. After the already-noted vendorHash issue is fixed, nix build/release nix-verify will still produce a binary with the pre-1.26.3 standard library, so the toolchain CVE fix in this PR does not apply to the Nix package unless the flake/toolchain override is updated too.

Useful? React with 👍 / 👎.

Flagged for human review — correct catch: the go_1_26 override pins a nixpkgs rev predating Go 1.26.3, so the toolchain CVE fix doesn't reach nix build/nix-verify. Fixing it requires nix flake update nixpkgs (to a rev shipping Go 1.26.3) plus a nix build verification — which needs a nix toolchain that isn't available in this environment. Leaving this for a maintainer with nix, together with the stale vendorHash refresh.

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

- Set 'toolchain go1.26.3' and bump golang.org/x/net to v0.55.0, clearing all govulncheck-reachable advisories (x509 name-constraint bypass, TLS KeyUpdate DoS, HTTP/2 loop, et al.). - Pin the gitleaks release download with a SHA-256 checksum before install. The standalone gosec scan stays advisory (-no-fail, full SARIF upload). Its enforcing counterpart is golangci-lint (make lint), which honors the repo's per-site //nolint:gosec suppressions; the standalone binary can't read those, and globally excluding rule IDs (e.g. G101/G204) to make it hard-fail would blind release scans to new hard-coded creds / unsafe exec.

Copilot AI review requested due to automatic review settings May 30, 2026 05:58

github-actions Bot added ci CI/CD workflows deps labels May 30, 2026

Copilot started reviewing on behalf of jeremy May 30, 2026 05:58 View session

cubic-dev-ai Bot reviewed May 30, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed May 30, 2026

View reviewed changes

Comment thread .github/workflows/security.yml Outdated

Copilot AI reviewed May 30, 2026

View reviewed changes

Comment thread .github/workflows/security.yml Outdated

jeremy force-pushed the security/05-perms-and-exec-args branch from e4a7a62 to a3ff017 Compare May 30, 2026 06:05

jeremy force-pushed the security/06-supply-chain-ci branch from feaed83 to 3d62a58 Compare May 30, 2026 06:05

jeremy force-pushed the security/05-perms-and-exec-args branch from a3ff017 to c1d95a4 Compare May 30, 2026 06:13

Copilot AI review requested due to automatic review settings May 30, 2026 06:13

jeremy force-pushed the security/06-supply-chain-ci branch from 3d62a58 to 54c2ef1 Compare May 30, 2026 06:13

Copilot started reviewing on behalf of jeremy May 30, 2026 06:14 View session

Copilot AI reviewed May 30, 2026

View reviewed changes

Comment thread .github/workflows/security.yml

chatgpt-codex-connector Bot reviewed May 30, 2026

View reviewed changes

jeremy force-pushed the security/05-perms-and-exec-args branch from c1d95a4 to fc26287 Compare May 30, 2026 06:24

jeremy force-pushed the security/06-supply-chain-ci branch from 54c2ef1 to 6f3eab7 Compare May 30, 2026 06:24

jeremy force-pushed the security/05-perms-and-exec-args branch from fc26287 to 7ae26db Compare May 30, 2026 07:51

Copilot AI review requested due to automatic review settings May 30, 2026 07:51

jeremy force-pushed the security/06-supply-chain-ci branch from 6f3eab7 to 41c42c5 Compare May 30, 2026 07:51

Copilot started reviewing on behalf of jeremy May 30, 2026 07:51 View session

github-actions Bot added the bug Something isn't working label May 30, 2026

Copilot AI reviewed May 30, 2026

View reviewed changes

Comment thread .github/workflows/security.yml

jeremy force-pushed the security/05-perms-and-exec-args branch from 7ae26db to 36ba2ba Compare May 30, 2026 08:27

Copilot AI reviewed May 30, 2026

View reviewed changes

jeremy force-pushed the security/05-perms-and-exec-args branch from bc24216 to ad2b30a Compare May 30, 2026 09:12

jeremy force-pushed the security/06-supply-chain-ci branch from 4a9bbb1 to 31f48c0 Compare May 30, 2026 09:12

jeremy force-pushed the security/05-perms-and-exec-args branch from ad2b30a to fc5ac07 Compare May 30, 2026 09:34

Copilot AI review requested due to automatic review settings May 30, 2026 09:34

jeremy force-pushed the security/06-supply-chain-ci branch from 31f48c0 to 7f01606 Compare May 30, 2026 09:34

Copilot started reviewing on behalf of jeremy May 30, 2026 09:34 View session

Copilot AI reviewed May 30, 2026

View reviewed changes

jeremy force-pushed the security/05-perms-and-exec-args branch from fc5ac07 to 66b34b2 Compare May 30, 2026 09:50

jeremy force-pushed the security/06-supply-chain-ci branch from 7f01606 to 2bc0b51 Compare May 30, 2026 09:50

github-actions Bot added bug Something isn't working and removed enhancement New feature or request labels May 30, 2026

jeremy force-pushed the security/05-perms-and-exec-args branch from 66b34b2 to 0fcf67d Compare May 30, 2026 10:07

Copilot AI review requested due to automatic review settings May 30, 2026 10:07

jeremy force-pushed the security/06-supply-chain-ci branch from 2bc0b51 to 0cb36ba Compare May 30, 2026 10:07

Copilot started reviewing on behalf of jeremy May 30, 2026 10:07 View session

Copilot AI reviewed May 30, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed May 30, 2026

View reviewed changes

jeremy force-pushed the security/05-perms-and-exec-args branch from 0fcf67d to 02eb78d Compare May 30, 2026 10:25

jeremy force-pushed the security/06-supply-chain-ci branch from 0cb36ba to 111f276 Compare May 30, 2026 10:25

jeremy force-pushed the security/05-perms-and-exec-args branch from 02eb78d to 11ec5f7 Compare May 30, 2026 10:42

jeremy force-pushed the security/06-supply-chain-ci branch from 111f276 to 2b34a75 Compare May 30, 2026 10:42

Copilot AI review requested due to automatic review settings May 30, 2026 10:42

Copilot started reviewing on behalf of jeremy May 30, 2026 10:42 View session

Copilot AI reviewed May 30, 2026

View reviewed changes

jeremy force-pushed the security/05-perms-and-exec-args branch from 11ec5f7 to 4598b69 Compare May 30, 2026 11:00

jeremy force-pushed the security/06-supply-chain-ci branch from 2b34a75 to 5522054 Compare May 30, 2026 11:00

github-actions Bot added enhancement New feature or request and removed bug Something isn't working labels May 30, 2026

Conversation

jeremy commented May 30, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bump toolchain/x-net for CVEs and tighten CI security gates

Part 6/6 of the stacked security series. Base: security/05-perms-and-exec-args. Suggest landing last, since the gosec gate is the most likely to surface a follow-up.

📚 Stack (merge bottom-up)

Summary by cubic

Uh oh!

github-actions Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sensitive Change Detection (shadow mode)

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 30, 2026

Choose a reason for hiding this comment

Uh oh!

jeremy May 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 30, 2026

Choose a reason for hiding this comment

Uh oh!

jeremy May 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jeremy commented May 30, 2026 •

edited by cubic-dev-ai Bot

Loading

Part 6/6 of the stacked security series. Base: `security/05-perms-and-exec-args`. Suggest landing last, since the gosec gate is the most likely to surface a follow-up.

github-actions Bot commented May 30, 2026 •

edited

Loading