deps: bump x/net, x/text, x/sys to fix remaining CVEs - #1196
Merged
Conversation
Follow-up to envoyproxy#1154 (which bumped x/net to 0.55.0). Bumps the golang.org/x dependencies to their latest patched releases to remediate the CVEs still outstanding after envoyproxy#1154: - golang.org/x/net v0.55.0 -> v0.57.0 (CVE-2026-46600, fixed in 0.56.0) - golang.org/x/text v0.37.0 -> v0.40.0 (CVE-2026-56852, fixed in 0.39.0) - golang.org/x/sys v0.45.0 -> v0.47.0 (already patched; kept current) No source changes required; `go build ./...` passes. Signed-off-by: Yitong Feng <yife@microsoft.com>
YitongFeng-git
force-pushed
the
cve-fix-x-net-x-text
branch
from
July 27, 2026 01:41
f5494d4 to
2ef0d34
Compare
YitongFeng-git
changed the title
Contributor
Author
|
@collin-lee @ysawa0 could you help review? Thanks |
Contributor
Author
|
gently ping @collin-lee @ysawa0 |
collin-lee
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #1154 (which already bumped
golang.org/x/netto v0.55.0 and Go to 1.26.4). This bumps thegolang.org/xdependencies to their latest patched releases to remediate the CVEs that are still outstanding onmainafter #1154. Dependency-only change — no source changes;go build ./...passes.golang.org/x/netgolang.org/x/textgolang.org/x/sysCVEs remediated (still open after #1154)
golang.org/x/sys(CVE-2026-39824, fixed in v0.44.0) was already resolved by v0.45.0 onmain; bumped to v0.47.0 to stay current. The other x/net CVEs (CVE-2026-25680/25681/27136/33814/39821/42502/42506) were already resolved by v0.55.0 in #1154.Testing
go mod tidy— clean,godirective unchanged (1.26.4)go build ./...— passes