t.behrendt/tracebasedlogsampler
1
0
Fork 0
Code Issues 1 Pull Requests 5 Actions Packages Releases Activity

chore(deps): update module golang.org/x/net to v0.56.0 [security] #78

Merged
renovate-bot merged 1 commits from renovate/go-golang.org-x-net-vulnerability into main 2026-07-22 15:00:18 +02:00
Conversation 1 Commits 1 Files Changed 2
+7 -3
renovate-bot commented 2026-07-22 06:10:39 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Change Age Confidence
golang.org/x/net v0.55.0 → v0.56.0 age confidence

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

CVE-2026-46600 / GO-2026-5942

More information

Details

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.55.0` → `v0.56.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.55.0...refs/tags/v0.56.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.56.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.55.0/v0.56.0?slim=true) | --- ### Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) / [GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942) <details> <summary>More information</summary> #### Details Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. #### Severity Unknown #### References - [https://go.dev/cl/786345](https://go.dev/cl/786345) - [https://go.dev/issue/79795](https://go.dev/issue/79795) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5942) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjMuOSIsInVwZGF0ZWRJblZlciI6IjQzLjI2My45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhdXRvbWVyZ2UiLCJzZWN1cml0eSJdfQ==-->
renovate-bot added the automergesecurity labels 2026-07-22 06:10:39 +02:00
renovate-bot added 1 commit 2026-07-22 06:10:40 +02:00
chore(deps): update module golang.org/x/net to v0.56.0 [security]
CI / test (push) Successful in 53s
Details
14ef267d0d
renovate-bot scheduled this pull request to auto merge when all checks succeed 2026-07-22 06:10:40 +02:00
renovate-bot commented 2026-07-22 06:10:40 +02:00
Author
Collaborator
Copy Link
Copy Source

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
golang.org/x/sys v0.45.0 -> v0.46.0
golang.org/x/text v0.37.0 -> v0.38.0
### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 2 additional dependencies were updated Details: | **Package** | **Change** | | :------------------ | :--------------------- | | `golang.org/x/sys` | `v0.45.0` -> `v0.46.0` | | `golang.org/x/text` | `v0.37.0` -> `v0.38.0` |
renovate-bot merged commit 434b89db58 into main 2026-07-22 15:00:18 +02:00
renovate-bot deleted branch renovate/go-golang.org-x-net-vulnerability 2026-07-22 15:00:18 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
action
automerge
deps
docker
go
k8s
npm
security
No Label automerge security
Milestone
No items
No Milestone
Assignees
Clear assignees
branch-buddy renovate-bot trivy-bot t.behrendt
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: t.behrendt/tracebasedlogsampler#78
Delete Branch "renovate/go-golang.org-x-net-vulnerability"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?