chore(deps): sustainment refresh — govulncheck back to zero - #56
Merged
Conversation
Clears every vulnerability govulncheck reported against the module. The CI and Release workflows were failing on that gate, which left v1.9.0 without its signed binaries. Go toolchain 1.26.3 -> 1.26.5 covers three standard-library advisories (GO-2026-5856 crypto/tls, GO-2026-5039 net/textproto, GO-2026-5037 crypto/x509). grpc 1.81.1 -> 1.82.1 clears GO-2026-6061 and otel 1.43.0 -> 1.44.0 clears GO-2026-5158. The build image pin follows the toolchain. govulncheck: 5 called vulnerabilities -> 0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Security-only release: the dependency refresh in the previous commit, cut so the Release workflow can publish signed binaries — the govulncheck gate had blocked them for v1.9.0. Chart appVersion follows to 1.9.1 so the default image tag pulls the patched build instead of the vulnerable 1.9.0 one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sustainment refresh — 2026-07-29
Generated by
/dev-sustain.Why now
The
CIandReleaseworkflows both fail on thegovulncheckgate (exit 3),which is why
v1.9.0shipped its Docker image and Helm chart but not itssigned binaries. The five advisories predate that release — the same five are
reported against
dd55eb2, the commit before the v1.9.0 merge. The last greenCIrun onmainwas 2026-05-20; these advisories were published since.Mode
full(Renovate detected: no)Applied bumps
go.mod,go.work)Dockerfilebuild imagegolang:1.26.3golang:1.26.5google.golang.org/grpcgo.opentelemetry.io/otel(+metric,sdk,trace, otlptrace exporters)go.opentelemetry.io/contrib/instrumentation/net/http/otelhttpgo.opentelemetry.io/proto/otlpgolang.org/x/cryptogolang.org/x/netgolang.org/x/sysgolang.org/x/textgoogle.golang.org/genproto/googleapis/{api,rpc}vendor/regenerated withgo work vendor(the module is in workspace mode, soplain
go mod vendorrefuses to run).Vulnerabilities
Cleared:
crypto/tls— Encrypted Client Hello privacy leaknet/textproto— unescaped input in errorscrypto/x509— inefficient hostname parsinggrpc— xDS RBAC / HTTP/2otel— baggage header length not cappedQuarantined
None — no upgrade broke a check, so no bisect pass was needed.
Major upgrades available (not applied)
None detected; every bump above stayed within minor/patch.
Checks (re-run after sustainment)
go build ./...go test -count=1 ./...— all packages passgovulncheck ./...— no vulnerabilities foundgolangci-lint run ./...— 12 goconst issues, byte-identical to the baseline onmain(no regression). Note these do not fire under the CI-pinned v2.11.4; the local binary is v2.12.2, whose goconst handling of test files changed.After merge
Retag to get the signed binaries published — either move
v1.9.0or cutv1.9.1.🤖 Generated with Claude Code