Skip to content

Commit 3868714

Browse files
Shelnutt2Shelnutt2
authored
fix: upgrade golang.org/x/net to v0.55.0 (release/2.29) (#25778)
Upgrades `golang.org/x/net` from v0.53.0 to v0.55.0 on the `release/2.29` branch to fix 5 x/net/html CVEs discovered in IronBank scan. ## CVEs Fixed | CVE | Description | |-----|-------------| | CVE-2026-25680 | DoS via cubic complexity algorithm in HTML tree construction | | CVE-2026-25681 | Incorrect handling of character references in DOCTYPE nodes (XSS) | | CVE-2026-27136 | Incorrect handling of namespaced elements in foreign content (XSS) | | CVE-2026-42502 | Incorrect handling of HTML elements in foreign content (XSS) | | CVE-2026-42506 | Failure to reject ASCII-only Punycode-encoded labels (privilege escalation) | ## Changes - `golang.org/x/net` v0.53.0 -> v0.55.0 - `golang.org/x/crypto` v0.50.0 -> v0.51.0 (transitive) - `golang.org/x/sys` v0.43.0 -> v0.45.0 (transitive) - `golang.org/x/term` v0.42.0 -> v0.43.0 (transitive) - `golang.org/x/text` v0.36.0 -> v0.37.0 (transitive) Linear: ENT-100 > Generated by Coder Agents on behalf of @Shelnutt2
1 parent de95683 commit 3868714

2 files changed

Lines changed: 3 additions & 3 deletions

File tree

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ require (
193193
golang.org/x/crypto v0.52.0
194194
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
195195
golang.org/x/mod v0.35.0
196-
golang.org/x/net v0.54.0
196+
golang.org/x/net v0.55.0
197197
golang.org/x/oauth2 v0.34.0
198198
golang.org/x/sync v0.20.0
199199
golang.org/x/sys v0.45.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1337,8 +1337,8 @@ golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
13371337
golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
13381338
golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
13391339
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
1340-
golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
1341-
golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
1340+
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
1341+
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
13421342
golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
13431343
golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
13441344
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

0 commit comments

Comments
 (0)