Skip to content

fix(deps): vuln major upgrades — 8 packages (major: 1 · minor: 7) [integration/testdata/fixtures/repo/gomod] - #61

Draft
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/major/go/gomod/1-1783348802
Draft

fix(deps): vuln major upgrades — 8 packages (major: 1 · minor: 7) [integration/testdata/fixtures/repo/gomod]#61
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/major/go/gomod/1-1783348802

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Jul 6, 2026

Copy link
Copy Markdown

Summary: Critical-severity security update — 8 packages upgraded (MAJOR changes included)

Manifests changed:

  • integration/testdata/fixtures/repo/gomod (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 v0.53.0 minor Transitive 17 CRITICAL, 14 HIGH, 17 MEDIUM, 1 UNKNOWN
google.golang.org/grpc v1.38.0 v1.82.0 minor Transitive 3 CRITICAL, 2 HIGH
golang.org/x/net v0.0.0-20211111083644-e5c967477495 v0.56.0 minor Direct 15 HIGH, 18 MEDIUM, 7 UNKNOWN
github.com/open-policy-agent/opa v0.35.0 v1.18.2 major Direct 11 HIGH, 4 MEDIUM
golang.org/x/text v0.3.6 v0.38.0 minor Transitive 6 HIGH
golang.org/x/sys v0.0.0-20211205182925-97ca703d548d v0.46.0 minor Direct 3 MEDIUM, 1 UNKNOWN
google.golang.org/protobuf v1.27.1 v1.36.11 minor Transitive 2 MEDIUM
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac v0.15.0 minor Transitive -

Warning

Major Version Upgrade

This update includes major version changes that may contain breaking changes. Please:

  • Review the changelog/release notes for breaking changes
  • Test thoroughly in a staging environment
  • Update any code that depends on changed APIs
  • Ensure all tests pass before merging

Security Details

🚨 Critical & High Severity (68 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
golang.org/x/crypto GO-2026-5006 CRITICAL Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GHSA-rm3j-f69w-wqmq CRITICAL golang.org/x/crypto/ssh vulnerable to infinite loop on large channel writes v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GO-2026-5023 CRITICAL Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GO-2026-5017 CRITICAL Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GHSA-vgwf-h737-ff37 CRITICAL golang.org/x/crypto/ssh: Invoking client can cause server deadlock on unexpected responses v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GO-2026-5019 CRITICAL Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GHSA-f5wc-c3c7-36mc CRITICAL golang.org/x/crypto/ssh/agent doesn't drop invoking agent constraints when forwarding keys v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GO-2026-5020 CRITICAL Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GHSA-89gr-r52h-f8rx CRITICAL golang.org/x/crypto/ssh: FIDO/U2F security key physical presence check can be bypassed v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GHSA-x527-x647-q7gg CRITICAL golang.org/x/crypto/ssh: Invoking VerifiedPublicKeyCallback permissions skip enforcement v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GO-2024-3321 CRITICAL Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 0.31.0 -
golang.org/x/crypto CVE-2024-45337 CRITICAL - v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GHSA-5cgq-3rg8-m6cv CRITICAL golang.org/x/crypto/ssh/knownhosts vulnerable to auth bypass via unenforced @Revoked status v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GO-2026-5021 CRITICAL Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GHSA-v778-237x-gjrc CRITICAL Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 0.31.0 -
golang.org/x/crypto GO-2026-5005 CRITICAL Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GHSA-jppx-rxg9-jmrx CRITICAL golang.org/x/crypto/ssh/agent doesn't enforce invoking key constraints v0.0.0-20201002170205-7f63de1d35b0 - -
google.golang.org/grpc CVE-2026-33186 critical gRPC-Go has an authorization bypass via missing leading slash in :path v1.38.0 - -
google.golang.org/grpc GO-2026-4762 critical Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc v1.38.0 1.79.3 -
google.golang.org/grpc GHSA-p77j-4mvh-x3m3 CRITICAL gRPC-Go has an authorization bypass via missing leading slash in :path v1.38.0 1.79.3 -
github.com/open-policy-agent/opa GO-2025-3660 high OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa v0.35.0 1.4.0 -
github.com/open-policy-agent/opa GO-2022-0587 high Out of bounds memory access in github.com/open-policy-agent/opa v0.35.0 0.40.0 -
github.com/open-policy-agent/opa GO-2024-3141 high OPA for Windows has an SMB force-authentication vulnerability in github.com/open-policy-agent/opa v0.35.0 0.68.0 -
github.com/open-policy-agent/opa GHSA-6m8w-jc87-6cr7 HIGH OPA server Data API HTTP path injection of Rego v0.35.0 1.4.0 -
github.com/open-policy-agent/opa GHSA-x7f3-62pm-9p38 HIGH Out of bounds memory access in github.com/open-policy-agent/opa v0.35.0 0.40.0 -
github.com/open-policy-agent/opa GO-2022-0574 HIGH Denial of service in github.com/open-policy-agent/opa v0.35.0 0.42.0 -
github.com/open-policy-agent/opa CVE-2025-46569 high OPA server Data API HTTP path injection of Rego v0.35.0 - -
github.com/open-policy-agent/opa CVE-2022-33082 HIGH - v0.35.0 - -
github.com/open-policy-agent/opa GHSA-2m4x-4q9j-w97g HIGH Denial of service in Open Policy Agent v0.35.0 0.42.0 -
github.com/open-policy-agent/opa CVE-2024-8260 high - v0.35.0 - -
github.com/open-policy-agent/opa CVE-2022-28946 high - v0.35.0 - -
golang.org/x/crypto GO-2021-0227 HIGH Panic on crafted authentication request message in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.0.0-20201216223049-8b5274cf687f -
golang.org/x/crypto GHSA-3vm4-22fp-5rfm HIGH golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability v0.0.0-20201002170205-7f63de1d35b0 0.0.0-20201216223049-8b5274cf687f -
golang.org/x/crypto GHSA-hcg3-q754-cr77 HIGH golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange v0.0.0-20201002170205-7f63de1d35b0 0.35.0 -
golang.org/x/crypto GO-2025-3487 HIGH Potential denial of service in golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 0.35.0 -
golang.org/x/crypto GO-2025-4116 HIGH Potential denial of service in golang.org/x/crypto/ssh/agent v0.0.0-20201002170205-7f63de1d35b0 0.43.0 -
golang.org/x/crypto GHSA-56w8-48fp-6mgv HIGH golang.org/x/crypto/ssh/agent has a potential denial of service v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GO-2021-0356 HIGH Denial of service via crafted Signer in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.0.0-20220314234659-1baeb1ce4c0b -
golang.org/x/crypto GHSA-8c26-wmh5-6g9v HIGH golang.org/x/crypto/ssh Denial of service via crafted Signer v0.0.0-20201002170205-7f63de1d35b0 0.0.0-20220314234659-1baeb1ce4c0b -
golang.org/x/crypto GHSA-w879-237q-wc7r HIGH golang.org/x/crypto/ssh: Invoking pathological RSA/DSA parameters may cause DoS v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GO-2026-5018 HIGH Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GHSA-gwc9-m7rh-j2ww HIGH x/crypto/ssh vulnerable to panic via malformed packets v0.0.0-20201002170205-7f63de1d35b0 0.0.0-20211202192323-5770296d904e -
golang.org/x/crypto GHSA-q4h4-gmj2-qvw2 HIGH golang.org/x/crypto/ssh: Invoking byte arithmetic causes underflow and panic v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GO-2026-5013 HIGH Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GO-2022-0968 HIGH Panic on malformed packets in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.0.0-20211202192323-5770296d904e -
golang.org/x/net GHSA-vc3p-29h2-gpcp HIGH golang.org/x/net/http2 allows uncontrolled memory consumption v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net GO-2022-0288 high Unbounded memory growth in net/http and golang.org/x/net/http2 v0.0.0-20211111083644-e5c967477495 0.0.0-20211209124913-491a49abca63 -
golang.org/x/net GHSA-69cg-p879-7622 HIGH golang.org/x/net/http2 Denial of Service vulnerability v0.0.0-20211111083644-e5c967477495 0.0.0-20220906165146-f3363e06e74c -
golang.org/x/net CVE-2022-27664 high - v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net GHSA-vvpx-j8f3-3w6h HIGH golang.org/x/net vulnerable to Uncontrolled Resource Consumption v0.0.0-20211111083644-e5c967477495 0.7.0 -
golang.org/x/net CVE-2022-41723 HIGH - v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net GO-2023-1571 HIGH Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net v0.0.0-20211111083644-e5c967477495 0.7.0 -
golang.org/x/net CVE-2021-44716 high - v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net CVE-2023-44487 high This package is related to CVE CVE-2023-44487 which was detected by cisa.gov as actively being exploited in the wild v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net GO-2023-2102 HIGH HTTP/2 rapid reset can cause excessive work in net/http v0.0.0-20211111083644-e5c967477495 0.17.0 -
golang.org/x/net CVE-2023-39325 HIGH - v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net GHSA-4374-p667-p6c8 HIGH HTTP/2 rapid reset can cause excessive work in net/http v0.0.0-20211111083644-e5c967477495 0.17.0 -
golang.org/x/net GHSA-w32m-9786-jp63 HIGH Non-linear parsing of case-insensitive content in golang.org/x/net/html v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net GO-2024-3333 HIGH Non-linear parsing of case-insensitive content in golang.org/x/net/html v0.0.0-20211111083644-e5c967477495 0.33.0 -
golang.org/x/net GO-2022-0969 high Denial of service in net/http and golang.org/x/net/http2 v0.0.0-20211111083644-e5c967477495 0.0.0-20220906165146-f3363e06e74c -
golang.org/x/text GHSA-ppp9-7jff-5vj2 HIGH golang.org/x/text/language Out-of-bounds Read vulnerability v0.3.6 0.3.7 -
golang.org/x/text CVE-2021-38561 HIGH - v0.3.6 - -
golang.org/x/text GO-2022-1059 HIGH Denial of service via crafted Accept-Language header in golang.org/x/text/language v0.3.6 0.3.8 -
golang.org/x/text CVE-2022-32149 HIGH - v0.3.6 - -
golang.org/x/text GHSA-69ch-w2m2-3vjp HIGH golang.org/x/text/language Denial of service via crafted Accept-Language header v0.3.6 0.3.8 -
golang.org/x/text GO-2021-0113 HIGH Out-of-bounds read in golang.org/x/text/language v0.3.6 0.3.7 -
google.golang.org/grpc GO-2023-2153 HIGH Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc v1.38.0 1.56.3 -
google.golang.org/grpc GHSA-m425-mq94-257g HIGH gRPC-Go HTTP/2 Rapid Reset vulnerability v1.38.0 1.56.3 -
ℹ️ Other Vulnerabilities (53)
Package CVE Severity Summary Unsafe Version Fixed In Case
github.com/open-policy-agent/opa GO-2022-0316 medium Incorrect calculation in github.com/open-policy-agent/opa v0.35.0 0.37.2 -
github.com/open-policy-agent/opa CVE-2022-23628 medium Array literal misordering in github.com/open-policy-agent/opa v0.35.0 - -
golang.org/x/crypto GO-2023-2402 medium Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 0.17.0 -
golang.org/x/crypto CVE-2023-48795 medium - v0.0.0-20201002170205-7f63de1d35b0 - -
github.com/open-policy-agent/opa GHSA-c77r-fh37-x2px MODERATE OPA for Windows has an SMB force-authentication vulnerability v0.35.0 0.68.0 -
github.com/open-policy-agent/opa GHSA-hcw3-j74m-qc58 MODERATE Incorrect Calculation in github.com/open-policy-agent/opa v0.35.0 0.37.2 -
golang.org/x/crypto GO-2026-5016 MODERATE Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GO-2026-5015 MODERATE Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GHSA-9m57-25v3-79x9 MODERATE golang.org/x/crypto/ssh/agent: Invoking pathological inputs can lead to client panic v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GHSA-j5w8-q4qc-rx2x MODERATE golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption v0.0.0-20201002170205-7f63de1d35b0 0.45.0 -
golang.org/x/crypto GO-2026-5014 MODERATE Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto CVE-2025-58181 MODERATE - v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GO-2025-4134 MODERATE Unbounded memory consumption in golang.org/x/crypto/ssh v0.0.0-20201002170205-7f63de1d35b0 0.45.0 -
golang.org/x/crypto GHSA-45x7-px36-x8w8 MODERATE Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin v0.0.0-20201002170205-7f63de1d35b0 0.17.0 -
golang.org/x/crypto GHSA-f6x5-jh6r-wrfv MODERATE golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read v0.0.0-20201002170205-7f63de1d35b0 0.45.0 -
golang.org/x/crypto GHSA-45gg-vh54-h5m9 MODERATE golang.org/x/crypto/ssh vulnerable to invoking bypass of certificate restrictions v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto CVE-2025-47914 MODERATE - v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GO-2025-4135 MODERATE Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent v0.0.0-20201002170205-7f63de1d35b0 0.45.0 -
golang.org/x/crypto GO-2026-5033 MODERATE Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent v0.0.0-20201002170205-7f63de1d35b0 0.52.0 -
golang.org/x/crypto GHSA-qpw4-5x99-6vjp MODERATE golang.org/x/crypto/ssh: Invoking memory leak when rejecting channels can lead to DoS v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/crypto GHSA-78mq-xcr3-xm33 MODERATE golang.org/x/crypto/ssh is vulnerable to invoking server panic during CheckHostKey/Authenticate flow v0.0.0-20201002170205-7f63de1d35b0 - -
golang.org/x/net CVE-2022-41717 MODERATE - v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net GHSA-2wrh-6pvc-2jm9 MODERATE Improper rendering of text nodes in golang.org/x/net/html v0.0.0-20211111083644-e5c967477495 0.13.0 -
golang.org/x/net GHSA-qxp5-gwg8-xv66 MODERATE HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net v0.0.0-20211111083644-e5c967477495 0.36.0 -
golang.org/x/net GO-2025-3595 MODERATE Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net v0.0.0-20211111083644-e5c967477495 0.38.0 -
golang.org/x/net GHSA-4v7x-pqxf-cx7m MODERATE net/http, x/net/http2: close connections when receiving too many headers v0.0.0-20211111083644-e5c967477495 0.23.0 -
golang.org/x/net GO-2026-5028 MODERATE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.0.0-20211111083644-e5c967477495 0.55.0 -
golang.org/x/net GHSA-xrjj-mj9h-534m MODERATE golang.org/x/net/http2 vulnerable to possible excessive memory growth v0.0.0-20211111083644-e5c967477495 0.4.0 -
golang.org/x/net GO-2022-1144 MODERATE Excessive memory growth in net/http and golang.org/x/net/http2 v0.0.0-20211111083644-e5c967477495 0.4.0 -
golang.org/x/net GHSA-vvgc-356p-c3xw MODERATE golang.org/x/net vulnerable to Cross-site Scripting v0.0.0-20211111083644-e5c967477495 0.38.0 -
golang.org/x/net GO-2026-4440 MODERATE Quadratic parsing complexity in golang.org/x/net/html v0.0.0-20211111083644-e5c967477495 0.45.0 -
golang.org/x/net GHSA-w4gw-w5jq-g9jh MODERATE golang.org/x/net/html has a Quadratic Parsing Complexity issue v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net GHSA-qppj-fm5r-hxr3 MODERATE HTTP/2 Stream Cancellation Attack v0.0.0-20211111083644-e5c967477495 0.17.0 -
golang.org/x/net CVE-2023-44487 MODERATE - v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net GHSA-5cv4-jp36-h3mw MODERATE Go Net HTML parser is vulnerable to denial of service v0.0.0-20211111083644-e5c967477495 0.55.0 -
golang.org/x/net GO-2024-2687 MODERATE HTTP/2 CONTINUATION flood in net/http v0.0.0-20211111083644-e5c967477495 0.23.0 -
golang.org/x/net GO-2023-1988 MODERATE Improper rendering of text nodes in golang.org/x/net/html v0.0.0-20211111083644-e5c967477495 0.13.0 -
golang.org/x/net CVE-2023-3978 MODERATE - v0.0.0-20211111083644-e5c967477495 - -
golang.org/x/net GO-2025-3503 MODERATE HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net v0.0.0-20211111083644-e5c967477495 0.36.0 -
golang.org/x/sys CVE-2022-29526 MODERATE - v0.0.0-20211205182925-97ca703d548d - -
golang.org/x/sys GHSA-p782-xgp4-8hr8 MODERATE golang.org/x/sys/unix has Incorrect privilege reporting in syscall v0.0.0-20211205182925-97ca703d548d 0.0.0-20220412211240-33da011f77ad -
golang.org/x/sys GO-2022-0493 MODERATE Incorrect privilege reporting in syscall and golang.org/x/sys/unix v0.0.0-20211205182925-97ca703d548d 0.0.0-20220412211240-33da011f77ad -
google.golang.org/protobuf GO-2024-2611 MODERATE Infinite loop in JSON unmarshaling in google.golang.org/protobuf v1.27.1 1.33.0 -
google.golang.org/protobuf GHSA-8r3f-844c-mc37 MODERATE Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON v1.27.1 1.33.0 -
golang.org/x/crypto GO-2024-2961 unknown Limited directory traversal vulnerability on Windows in golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 0.0.0-20220525230936-793ad666bf5e -
golang.org/x/net GO-2026-5027 unknown Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.0.0-20211111083644-e5c967477495 0.55.0 -
golang.org/x/net GO-2026-5029 unknown Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.0.0-20211111083644-e5c967477495 0.55.0 -
golang.org/x/net GO-2026-5026 unknown Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.0.0-20211111083644-e5c967477495 0.55.0 -
golang.org/x/net GO-2026-5025 unknown Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.0.0-20211111083644-e5c967477495 0.55.0 -
golang.org/x/net GO-2026-4441 unknown Infinite parsing loop in golang.org/x/net v0.0.0-20211111083644-e5c967477495 0.45.0 -
golang.org/x/net GO-2026-5030 unknown Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.0.0-20211111083644-e5c967477495 0.55.0 -
golang.org/x/net GO-2026-4918 unknown Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.0.0-20211111083644-e5c967477495 0.53.0 -
golang.org/x/sys GO-2026-5024 unknown Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows v0.0.0-20211205182925-97ca703d548d 0.44.0 -
⚠️ Dependencies that have Reached EOL (8)
Dependency Unsafe Version EOL Date New Version Path
github.com/open-policy-agent/opa v0.35.0 - v1.18.2 integration/testdata/fixtures/repo/gomod/go.mod
golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 - v0.53.0 integration/testdata/fixtures/repo/gomod/go.mod
golang.org/x/net v0.0.0-20211111083644-e5c967477495 - v0.56.0 integration/testdata/fixtures/repo/gomod/go.mod
golang.org/x/sys v0.0.0-20211205182925-97ca703d548d - v0.46.0 integration/testdata/fixtures/repo/gomod/go.mod
golang.org/x/text v0.3.6 - v0.38.0 integration/testdata/fixtures/repo/gomod/go.mod
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac - v0.15.0 integration/testdata/fixtures/repo/gomod/go.mod
google.golang.org/grpc v1.38.0 - v1.82.0 integration/testdata/fixtures/repo/gomod/go.mod
google.golang.org/protobuf v1.27.1 - v1.36.11 integration/testdata/fixtures/repo/gomod/go.mod

Review Checklist

Extra review is recommended for this update:

  • Review changes for compatibility with your code
  • Check release notes for breaking changes
  • Run integration tests to verify service behavior
  • Test in staging environment before production
  • Monitor key metrics after deployment
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-critical-severity adms-dependency-update adms-fixes-eol adms-go adms-high-severity adms-major-update adms-medium-severity adms-mode-all-vulns campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants