deps: bump vulnerable Go dependencies - #1351
Open
bigbes wants to merge 1 commit into
Open
Conversation
Update the Go modules flagged by Dependabot and govulncheck across the root module, lib/cluster, lib/connect, lib/dial and the aeon test server. - Bump golang.org/x/crypto 0.49.0/0.51.0 -> 0.54.0, which closes twelve advisories, seven of them critical. - Bump golang.org/x/net 0.52.0/0.53.0 -> 0.57.0 (GHSA-5cv4-jp36-h3mw). - Bump golang.org/x/text 0.35.0/0.37.0 -> 0.40.0. - Bump google.golang.org/grpc 1.79.3 -> 1.82.1 (GHSA-hrxh-6v49-42gf). - Bump go.opentelemetry.io/otel with its sdk and exporters from 1.34.0..1.42.0 to 1.44.0 (GHSA-mh2q-q3fh-2475, GHSA-hfvc-g4fc-pqhx, GHSA-w8rr-5gcm-pp58, GHSA-9h8m-3fm2-qjrq, GO-2026-5158). - Bump github.com/klauspost/compress 1.18.6 -> 1.18.7 (GO-2026-5841). - Let golang.org/x/sys, x/term and x/sync follow along to keep the module set consistent. github.com/docker/docker stays at v28.5.2+incompatible. Its advisories are fixed in Docker 29, which is published under the new module path github.com/moby/moby/v2 and has no stable release yet, so there is no version to bump to. The dependency is only reachable through the vendored cartridge-cli, which still imports github.com/docker/docker while cli/docker already uses github.com/moby/moby/client. After the bump govulncheck reports no vulnerability with a published fix left. The remaining findings are the docker ones above and GO-2026-5932 in golang.org/x/crypto, all marked "Fixed in: N/A". Part of TNTP-3131
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update the Go modules flagged by Dependabot and govulncheck across the root module,
lib/cluster,lib/connect,lib/dialand the aeon test server.golang.org/x/cryptogolang.org/x/netgolang.org/x/textgoogle.golang.org/grpcgo.opentelemetry.io/otel+ sdk/exportersgithub.com/klauspost/compressgolang.org/x/sys,x/termandx/syncfollow along to keep the module set consistent.Advisories closed: 12 for
x/crypto(7 critical), GHSA-5cv4-jp36-h3mw, GHSA-hrxh-6v49-42gf, GHSA-mh2q-q3fh-2475, GHSA-hfvc-g4fc-pqhx, GHSA-w8rr-5gcm-pp58, GHSA-9h8m-3fm2-qjrq, GO-2026-5158, GO-2026-5841.Not fixed here
github.com/docker/dockerstays atv28.5.2+incompatible. Its advisories are fixed in Docker 29, which is published under the new module pathgithub.com/moby/moby/v2and has no stable release yet (v2.0.0-beta.21at the time of writing), so there is no version to bump to. The dependency is only reachable through the vendored cartridge-cli, which still importsgithub.com/docker/dockerwhilecli/dockeralready usesgithub.com/moby/moby/client— migrating it is a separate change.GO-2026-5932ingolang.org/x/cryptoisFixed in: N/A; we are already on the latest release.The pip advisories in
test/requirements.txt(pytest,requests,protobuf) are out of scope for this PR.Testing
TT_CLI_BUILD_SSL=no mage buildsucceeds.go testis green in the root module,lib/cluster,lib/integrityandlib/connect(with thett_ssl_disable,go_tarantool_ssl_disabletags);test/integration/aeon/servercompiles.govulncheckreports no vulnerability with a published fix left.Part of TNTP-3131