Upgrade Golang packages to mitigate CVE vulnerability #3773
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ntner
approved these changes
Dec 10, 2025
ntner
left a comment
ntner
left a comment
There was a problem hiding this comment.
- Install and update to rack version
- Downgrade to previous version
- Telemetry based param groupings at install
- Common convox rack param set variations after install
- New application install and running with multiple resources
- Existing application working after upgrade
- Review and Deploy Workflows working across update
- General and build stress-testing
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What is the feature/update/fix?
This release includes a security patch for a vulnerability in a dependency used by the Convox v2 rack. This update addresses a security issue in the following package:
golang.org/x/crypto - Fixed vulnerability:
This security update ensures your Convox rack is protected against potential denial of service attacks that could affect system stability and availability.
How to use it?
This security update is automatically applied when you update your rack to the latest version. No additional configuration is required to benefit from this security fix.
To apply the update:
After updating, verify your rack is running the latest version:
Does it have a breaking change?
No, there are no breaking changes introduced with this security fix. All functionality remains the same while improving the security posture of your Convox rack.
Requirements
To use this feature, you must be on at least rack version
20251210170659.You can check your rack's version with the command
convox rack -r rackName.Update your rack to the latest version with the command
convox rack update -r rackName.