fix(security): upgrade golang.org/x/net v0.52.0 → v0.55.0 (govulncheck) - #50
Merged
Conversation
Resolves govulncheck findings GO-2026-5026 and GO-2026-4918 in golang.org/x/net, which affected aex-work-publisher's call path. Bumped x/net to v0.55.0 across all CI-matrix modules carrying the vulnerable v0.52.0 (defense-in-depth: the other modules pulled in the vulnerable version as an indirect dep without an active call path). go mod tidy on the three internal/telemetry consumers (aex-telemetry, aex-credentials-provider, aex-token-bank) reconciles their replace directives, transitively bumping them as well. Transitive bumps from the upgrade: crypto v0.49→0.51, sys v0.42→0.45, text v0.35→0.37. Verified: govulncheck clean, go vet clean, go test passing across all 20 CI modules.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves govulncheck findings GO-2026-5026 and GO-2026-4918 in
golang.org/x/net.These were flagged by the
govulncheckCI matrix as affectingaex-work-publisher's call path. Other modules carried the vulnerablex/net@v0.52.0as an indirect dependency without an active call path — bumped too for defense-in-depth.Changes
golang.org/x/netv0.52.0 → v0.55.0 across 14 modules (28 files:go.mod+go.sum).aex-work-publisher(flagged) + 10 other CI-matrix modules carrying the vulnerable version.internal/telemetryand its threereplace-linked consumers (aex-telemetry,aex-credentials-provider,aex-token-bank), reconciled viago mod tidy.crypto v0.49→0.51,sys v0.42→0.45,text v0.35→0.37.Verification (all 20 CI modules)
govulncheck ./...— 0 affecting vulnerabilitiesgo vet ./...— cleango test ./... -timeout 120s— all passingNotes
AP2/samples/goremains onx/net@v0.46.0— outside both CI matrices (not a deployed service), left as-is.