Skip to content

Commit 443bc1a

Browse files
Shelnutt2Shelnutt2
authored
fix: upgrade golang.org/x/net to v0.55.0 (5 html CVEs) (#25772)
Upgrades `golang.org/x/net` from v0.53.0 to v0.55.0 on `release/2.32` to address 5 CVEs in `x/net/html`: | CVE | Severity | Description | | --- | --- | --- | | CVE-2026-25680 | Low | DoS via cubic complexity in HTML tree construction | | CVE-2026-25681 | Low | Incorrect handling of character references in DOCTYPE (XSS) | | CVE-2026-27136 | Low | Incorrect handling of namespaced elements in foreign content (XSS) | | CVE-2026-42502 | Low | Incorrect handling of HTML elements in foreign content (XSS) | | CVE-2026-42506 | Low | Failure to reject ASCII-only Punycode-encoded labels (privilege escalation) | Transitive dependency bumps: - `golang.org/x/crypto` v0.50.0 -> v0.51.0 - `golang.org/x/sys` v0.43.0 -> v0.45.0 - `golang.org/x/term` v0.42.0 -> v0.43.0 - `golang.org/x/text` v0.36.0 -> v0.37.0 Fixes [ENT-92](https://linear.app/codercom/issue/ENT-92) Supersedes [ENT-28](https://linear.app/codercom/issue/ENT-28) > Generated with [Coder Agents](https://coder.com) by @Shelnutt2
1 parent 3fe6edd commit 443bc1a

2 files changed

Lines changed: 3 additions & 3 deletions

File tree

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -221,7 +221,7 @@ require (
221221
golang.org/x/crypto v0.52.0
222222
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
223223
golang.org/x/mod v0.35.0
224-
golang.org/x/net v0.54.0
224+
golang.org/x/net v0.55.0
225225
golang.org/x/oauth2 v0.36.0
226226
golang.org/x/sync v0.20.0
227227
golang.org/x/sys v0.45.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1400,8 +1400,8 @@ golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
14001400
golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
14011401
golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
14021402
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
1403-
golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
1404-
golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
1403+
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
1404+
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
14051405
golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
14061406
golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
14071407
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

0 commit comments

Comments
 (0)