Skip to content

fix(security): remediate CVE vulnerabilities in release-0.3 - #33

Merged
ulucinar merged 1 commit into
release-0.3from
fix/cve-remediation-release-0.3-20261016-125910
Oct 16, 2026
Merged

ulucinar merged 1 commit into
release-0.3from
fix/cve-remediation-release-0.3-20261016-125910

Conversation

@upbound-bot

Copy link
Copy Markdown

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA Severity Package Fixed Version
GO-2026-6612 Critical stdlib 1.26.9
GO-2026-6604 Critical stdlib 1.26.9
GO-2026-6612 Critical golang.org/x/net v0.60.0
GO-2026-6603 High stdlib 1.26.9
GO-2026-6611 High stdlib 1.26.9
GO-2026-6608 High stdlib 1.26.9
GO-2026-6607 High stdlib 1.26.9
GO-2026-6609 High stdlib 1.26.9
GO-2026-6613 High stdlib 1.26.9
GO-2026-6605 High stdlib 1.26.9
GO-2026-6610 High stdlib 1.26.9
GO-2026-6617 High stdlib 1.26.9
GO-2026-6603 High golang.org/x/net v0.60.0
GO-2026-6611 High golang.org/x/net v0.60.0
GO-2026-6610 High golang.org/x/net v0.60.0
GO-2026-6617 High golang.org/x/net v0.60.0
GO-2026-6599 Medium stdlib 1.26.9
GO-2026-6600 Medium stdlib 1.26.9

Changes Made

  • Updated Go version directive in go.mod from 1.26.6 to 1.26.9
  • Updated golang.org/x/net dependency from v0.58.0 to v0.60.0
  • Ran go mod tidy to update go.sum and transitive dependencies
  • Updated GO_VERSION in .github/workflows/ci.yml to 1.26.9

References

Verification

  • Rescanned with `cve-scan` skill after fixes
  • All listed vulnerabilities resolved

- Update Go version to 1.26.9 (fixes GO-2026-6612, GO-2026-6604, GO-2026-6603, GO-2026-6611, GO-2026-6608, GO-2026-6607, GO-2026-6609, GO-2026-6613, GO-2026-6605, GO-2026-6610, GO-2026-6617, GO-2026-6599, GO-2026-6600)
- Update golang.org/x/net to v0.60.0 (fixes GO-2026-6612, GO-2026-6603, GO-2026-6611, GO-2026-6610, GO-2026-6617)
- Update CI workflow Go version to 1.26.9

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>
@ulucinar
ulucinar merged commit c5e1fbc into release-0.3 Oct 16, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants