security: upgrade golang.org/x/net to v0.56.0 (fixes 5 CVEs) - #698
Conversation
Resolves GO-2026-5025, GO-2026-5027, GO-2026-5028, GO-2026-5029, GO-2026-5030 — XSS, DoS, and incorrect HTML parsing vulnerabilities in golang.org/x/net/html, all fixed in v0.55.0. Upgrading to v0.56.0 (latest). The affected call site is internal/release/verifypicker.go which uses html.ParseWithOptions on Hugo-rendered output. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VvRSACkAR6hSbfjKcytz56
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The dev-tools module had golang.org/x/net v0.52.0 as a transitive dependency of golangci-lint. Bump to v0.56.0 to match go.mod and eliminate the version skew. Coordinated upgrades to x/mod, x/sync, x/sys, x/text, and x/tools follow from MVS. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VvRSACkAR6hSbfjKcytz56
The previous commit upgraded golang.org/x/net in tools/go.mod but the go mod tidy was run with Go 1.25.0 (below the required 1.25.8), so the go.sum was missing entries for golang.org/x/tools v0.45.0 sub-packages needed by golangci-lint. Re-run with GOTOOLCHAIN=go1.25.11 to fill the gap. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VvRSACkAR6hSbfjKcytz56
|
🔍 Merge Queue — bisecting A larger batch failed CI. Bisection is isolating the culprit: this run tests up to 3 of 5 candidate PRs on Next: No action needed — you'll be notified when the culprit is isolated, this PR merges, or this PR returns to the queue for a later batch. |
|
⏳ Merge Queue — requeued The merge queue hit a transient error while processing this PR:
Next: No action needed — the queue will retry automatically on the next run. |
|
🔍 Merge Queue — bisecting A larger batch failed CI. Bisection is isolating the culprit: this run tests up to 2 of 3 candidate PRs on Next: No action needed — you'll be notified when the culprit is isolated, this PR merges, or this PR returns to the queue for a later batch. |
|
🔍 Merge Queue — bisecting A larger batch failed CI. Bisection is isolating the culprit: this run tests up to 1 of 1 candidate PRs on Next: No action needed — you'll be notified when the culprit is isolated, this PR merges, or this PR returns to the queue for a later batch. |
|
✅ Merge Queue — merged This PR landed on Next: Done — nothing more to do here. |
Addresses all stdlib govulncheck findings on go 1.25.x: GO-2026-5039 (net/textproto, unescaped errors), GO-2026-5037/4947/4946 (crypto/x509 XSS/DoS/chain), GO-2026-4982/4980 (html/template XSS), GO-2026-4971 (net NUL panic), GO-2026-4918 (HTTP/2 infinite loop), GO-2026-4870 (TLS KeyUpdate DoS), GO-2026-4869/4014 (archive/tar allocation), GO-2026-4602 (os FileInfo escape), GO-2026-4601/2025-4010 (net/url IPv6), and several earlier x509/tls/asn1/pem/http CVEs. The golang.org/x/net idna fix (GO-2026-5026) was already merged via #698. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WcKyJREutLqn5x3hbdGaKT
2 participants
Summary
Upgrades
golang.org/x/netfromv0.54.0tov0.56.0to resolve 5 security vulnerabilities detected bygovulncheckingolang.org/x/net/html.Vulnerabilities fixed
golang.org/x/net/htmlAll five are fixed in
v0.55.0; this PR upgrades tov0.56.0(latest).Affected call site
internal/release/verifypicker.go:51—html.ParseWithOptionsis called on Hugo-rendered homepage output. While this runs in the release pipeline on trusted input rather than user-supplied HTML, upgrading eliminates the vulnerability class entirely.Verification
govulncheck ./...→ No vulnerabilities foundgo build ./...→ cleango test ./...→ all packages passTest plan
govulncheck ./...reports no vulnerabilities after the upgradego test ./...)go build ./...)🤖 Generated with Claude Code
https://claude.ai/code/session_01VvRSACkAR6hSbfjKcytz56
Generated by Claude Code