Repository navigation
fix(deps): bump golang.org/x/net to v0.60.0 and Go to 1.26.9 - #708
Merged
Merged
Conversation
Fixes GO-2026-6612 (CVE-2026-78663), an HTTP/2 flow-control issue in golang.org/x/net/http2 and the bundled copy in net/http. - golang.org/x/net v0.56.0 -> v0.60.0, which also clears GO-2026-6603, GO-2026-6610, GO-2026-6611 and CVE-2026-78669. MVS raises the rest of golang.org/x with it (crypto v0.57.0, mod v0.41.0, sync v0.23.0, sys v0.48.0, term v0.46.0, text v0.42.0), which also clears the x/crypto and x/text HIGH findings on the current image. - go directive 1.26.4 -> 1.26.9. CI and the release job install Go from go.mod, so this pins those builds (including the arctl release binaries) to the patched stdlib. The server image's golang:1.26-alpine builder runs with GOTOOLCHAIN=local, so a stale cached base older than 1.26.9 now fails the build instead of shipping a vulnerable stdlib.
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No blocking issues were identified in the dependency-only changes, and the PR reports successful build, test, and verification checks.
0 open findings
What changed in this PR
Updates Go and related dependencies to address HTTP/2 security vulnerabilities in the registry and CLI builds.
Changes:
- Raises the minimum Go version to 1.26.9.
- Upgrades
golang.org/x/netto v0.60.0 and related modules. - Refreshes dependency checksums.
| File | Description |
|---|---|
| go.sum | Updates checksums for upgraded dependencies. |
| go.mod | Raises the Go minimum and dependency versions. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Sodman
approved these changes
Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Motivation: the server image is flagged CRITICAL for GO-2026-6612 (CVE-2026-78663), an HTTP/2 flow-control issue in
golang.org/x/net/http2and the copy bundled innet/http. The fix ships ingolang.org/x/netv0.60.0 and Go 1.26.9.What changed (go.mod/go.sum only):
golang.org/x/netv0.56.0 -> v0.60.0. MVS raises the rest ofgolang.org/xwith it: crypto v0.57.0, mod v0.41.0, sync v0.23.0, sys v0.48.0, term v0.46.0, text v0.42.0.godirective 1.26.4 -> 1.26.9. CI and the release job install Go fromgo-version-file: go.mod, so without this thearctlrelease binaries would still build on go1.26.4. It also guards the server image: thegolang:1.26-alpinebuilder runs withGOTOOLCHAIN=local, so a stale cached base older than 1.26.9 now fails withgo.mod requires go >= 1.26.9instead of building a vulnerable stdlib.Change Type
/kind fix
/kind bump
Changelog
Additional Notes
Scanned a local
linux/arm64build ofdocker/server.Dockerfilewith grype (--only-fixed) and trivy (--severity HIGH,CRITICAL):main@ c234049x/net), plus thex/cryptov0.53.0 andx/textv0.39.0 HIGHs picked up by the same bump.mainbuild was already on go1.26.9 becausegolang:1.26-alpinenow resolves there; the publishedv0.4.0image also carries the stdlib findings (go1.26.4/go1.26.5).go version -mon the new binary: go1.26.9,golang.org/x/netv0.60.0.x/netor stdlib findings at any severity.libssl3from theubuntu:22.04runtime base, unrelated to this change.Local checks:
go build ./...,make test-unit(1551 passed),make verifyclean.