Bump golang.org/x/mod to v0.40.0 (CVE-2026-56864, CVE-2026-56865) - #1352
Merged
Conversation
golang.org/x/mod v0.37.0 is flagged for two HIGH severity issues in sumdb: a malicious GOSUMDB could serve arbitrary module content, and tlog tile verification could be bypassed. The module reaches us only through the `tool` directive (gofumpt, gci), so it is not linked into the exporter binary, but bump it to clear the scanner. `go mod tidy` also pulls forward x/crypto, x/net, x/text and x/tools as transitive requirements.
ademidoff
requested review from
4nte and
JiriCtvrtka
and removed request for
a team
August 28, 2026 21:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Trivy flags
golang.org/x/mod v0.37.0for two HIGH severity vulnerabilities:sumdb/tlog: supply chain compromise via transparency log tile verification bypassBoth are fixed in
v0.40.0.Notes on exposure
golang.org/x/modreaches this module only through thetooldirective (mvdan.cc/gofumpt,github.com/daixiang0/gci) —go mod why -m golang.org/x/modresolves viamvdan.cc/gofumpt -> golang.org/x/mod/modfile. It is not linked into the exporter binary, so the CVEs are not runtime-exploitable here. The bump is to clear the scanner.tools/go.modwas already onv0.40.0.Change
go get golang.org/x/mod@v0.40.0 && go mod tidy. This also pulls forward the transitive requirements:golang.org/x/cryptov0.54.0 -> v0.55.0golang.org/x/modv0.37.0 -> v0.40.0golang.org/x/netv0.57.0 -> v0.58.0golang.org/x/textv0.40.0 -> v0.41.0golang.org/x/toolsv0.47.0 -> v0.49.0No source changes; no dependencies added or removed.
Verification
go build ./...andgo vet ./...pass.govulncheck ./...no longer reportsgolang.org/x/mod.go test ./...produces an identical set of failures on this branch and onmain— all of them require the docker-compose MongoDB cluster (make test-cluster), which was not running locally.Out of scope
govulncheckseparately reports GO-2026-5764 againstgithub.com/aws/aws-sdk-go-v2/service/s3@v1.95.1and.../aws/protocol/eventstream@v1.7.4(reachable viaexporter/pbm_collector.go). That was not in the Trivy report this PR addresses and is left for a separate change.