Repository navigation
Update indirect Go module dependencies - #32
Merged
Merged
Conversation
Moves golang.org/x/net to v0.61.0, past five HTTP/2 advisories (GO-2026-6603, -6610, -6611, -6612, -6617) that govulncheck reports as reachable on main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Raises the go directive and the CI and release toolchains from 1.26. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Go 1.27 drops macOS 12 and the go 1.27 directive flips the x509sslcertoverrideplatform default; no dependency needs it yet. This reverts commit 27f4e3c. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
polarn
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates every indirect module (
go get -u ./...).golang.org/x/netmoves to v0.61.0, which clears five HTTP/2 advisories that govulncheck reports as reachable on main: GO-2026-6603, -6610, -6611, -6612 and -6617.github.com/kr/textas an indirect requirement. Only the tests ofyaml.v3need it (go mod why -m github.com/kr/text), and it is not linked into the binary.govulncheck ./...now reports nothing reachable. The one module-level finding left is GO-2026-5932, for the unmaintainedx/crypto/openpgppackage, which is not imported and has no fix.🤖 Generated with Claude Code