Repository navigation
Update x/net to v0.60.0 to fix govulncheck failures - #2401
Merged
Julian Gutierrez Oschmann (juli4n) merged 3 commits intoOct 10, 2026
Merged
Julian Gutierrez Oschmann (juli4n) merged 3 commits into
Julian Gutierrez Oschmann (juli4n) merged 3 commits into
Conversation
Update golang.org/x/net to v0.60.0 in both scanned modules to pick up the HTTP/2 security fixes. Regenerate vendor and include the required transitive dependency updates.
# Conflicts: # go.mod
Max Smythe (maxsmythe)
enabled auto-merge
October 10, 2026 05:06
apitool replaces github.com/agent-substrate/substrate with the local checkout, so its go.mod must record at least the versions the root module's graph requires. The root's x/net v0.60.0 bump left apitool pinned at v0.58.0 and CI's apitool test step failed with "updates to go.mod needed". Align x/net and its companions (x/sync, x/sys, x/text).
auto-merge was automatically disabled
October 10, 2026 06:06
Head branch was pushed to by a user without write access
Julian Gutierrez Oschmann (juli4n)
approved these changes
Oct 10, 2026
Julian Gutierrez Oschmann (juli4n)
enabled auto-merge
October 10, 2026 15:11
Merged
via the queue into
agent-substrate:main
with commit Oct 10, 2026
d1b2371
20 of 22 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both modules in the post-merge govulncheck matrix resolve golang.org/x/net v0.58.0 and fail on five newly published HTTP/2 vulnerabilities. Update x/net to v0.60.0 in the root module and the GCP Secret Manager plugin, include its required transitive dependency updates, and regenerate vendor.
Go also updates the required x/crypto, x/sync, x/sys, x/term, and x/text versions. All first-party changes are in the two go.mod/go.sum pairs; the other changes are generated vendor updates.
Affected advisories: GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, and GO-2026-6617.
The latest failing main run already selects Go 1.27.2; its remaining failures are all in x/net. The earlier standard-library findings were resolved by the workflow selecting the patched stable toolchain. This change preserves the current Go version requirement.
Validation after merging main
59072f7b:go test -race -count=1 ./...passed with PostgreSQL/envtest integration enabled (CI=true).bash hack/verify-all.shpassed, including generated-code and vendor consistency, and the checkout remained clean.The merge retains main's direct x/net dependency classification at v0.60.0. Canonical v0.60.0 DNS parser content was restored in vendor after the generation check found that the automatic merge had retained three older statements.
Verification ran as an unprivileged user. Root-gated mount tests and real cluster E2E were not run for this head.
AI assistance was used to resolve the merge conflicts and run verification.