Skip to content

fix(security): remediate CVE vulnerabilities for release-0.11 - #378

Merged
ulucinar merged 1 commit into
release-0.11from
fix/cve-remediation-release-0.11-20261016-153629
Oct 16, 2026
Merged

ulucinar merged 1 commit into
release-0.11from
fix/cve-remediation-release-0.11-20261016-153629

Conversation

@ulucinar

Copy link
Copy Markdown
Collaborator

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA Severity Package Fixed Version
GO-2026-6612 Critical stdlib 1.26.9
GO-2026-6604 Critical stdlib 1.26.9
GO-2026-6612 Critical golang.org/x/net v0.60.0
GO-2026-6603 High stdlib 1.26.9
GO-2026-6611 High stdlib 1.26.9
GO-2026-6603 High golang.org/x/net v0.60.0
GO-2026-6611 High golang.org/x/net v0.60.0
GO-2026-6608 High stdlib 1.26.9
GO-2026-6607 High stdlib 1.26.9
GO-2026-6609 High stdlib 1.26.9
GO-2026-6613 High stdlib 1.26.9
GO-2026-6605 High stdlib 1.26.9
GO-2026-6610 High stdlib 1.26.9
GO-2026-6610 High golang.org/x/net v0.60.0
GO-2026-6617 High stdlib 1.26.9
GO-2026-6617 High golang.org/x/net v0.60.0
GO-2026-6599 Medium stdlib 1.26.9
GO-2026-6600 Medium stdlib 1.26.9

Changes Made

  • Updated Go version from 1.26.8 to 1.26.9 in go.mod
  • Updated golang.org/x/net from v0.58.0 to v0.60.0 in go.mod
  • Ran go mod tidy to update go.sum
  • Updated GO_VERSION from 1.26.8 to 1.26.9 in .github/workflows/ci.yml

References

Verification

  • Rescanned with cve-scan skill after fixes
  • All listed vulnerabilities resolved

- Update Go version to 1.26.9 (fixes GO-2026-6612, GO-2026-6604, GO-2026-6603, GO-2026-6611, GO-2026-6608, GO-2026-6607, GO-2026-6609, GO-2026-6613, GO-2026-6605, GO-2026-6610, GO-2026-6617, GO-2026-6599, GO-2026-6600)
- Update golang.org/x/net to v0.60.0 (fixes GO-2026-6612, GO-2026-6603, GO-2026-6611, GO-2026-6610, GO-2026-6617)
- Update CI workflow Go version to 1.26.9

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>
@ulucinar
ulucinar merged commit 81e9f0d into release-0.11 Oct 16, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants