From c6229c46f7a3928a8fad8be3c75598fc5e72b9fe Mon Sep 17 00:00:00 2001 From: Bakhtiyar Issakhmetov Date: Thu, 15 Oct 2026 21:53:51 +0500 Subject: [PATCH] build(deps): go1.26.9 and golang.org/x/net v0.60.0 Close stdlib (net/http, crypto/tls, mime/multipart, net/http/httputil) and x/net advisories published after the go1.26.8 release (GO-2026-6603..6617, CVE-2026-78667/78669/97031). Co-Authored-By: Claude Opus 5.5 --- build/package/Dockerfile | 6 +++--- go.mod | 12 ++++++------ go.sum | 28 ++++++++++++++-------------- 3 files changed, 23 insertions(+), 23 deletions(-) diff --git a/build/package/Dockerfile b/build/package/Dockerfile index 873860b..cb6400e 100644 --- a/build/package/Dockerfile +++ b/build/package/Dockerfile @@ -1,8 +1,8 @@ # Build context is the repo root: docker build -f build/package/Dockerfile . # Go patch release pinned (not the floating 1.26 tag) so the shipped standard -# library is reproducible and includes the security fixes up to go1.26.8; +# library is reproducible and includes the security fixes up to go1.26.9; # keep in step with the `toolchain` line in go.mod. -FROM golang:1.26.8-alpine3.24 AS builder +FROM golang:1.26.9-alpine3.24 AS builder # godal (GDAL bindings) needs cgo, a C/C++ toolchain and the GDAL headers. # g++ is required: parts of the binding compile as C++ against GDAL's headers. @@ -17,7 +17,7 @@ COPY . . RUN CGO_ENABLED=1 GOOS=linux go build -trimpath -o /out/gis ./cmd/gis # Must stay on the same Alpine release as the builder — hence the pinned -# `golang:1.26.8-alpine3.24` above rather than the floating `-alpine` tag. A +# `golang:1.26.9-alpine3.24` above rather than the floating `-alpine` tag. A # mismatch ships a different libgdal soname, and the image still builds green # while the binary dies at startup with "libgdal.so.NN: No such file". # Bump both lines together. diff --git a/go.mod b/go.mod index 0e442f5..4632453 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module gis go 1.26.1 -toolchain go1.26.8 +toolchain go1.26.9 require ( github.com/airbusgeo/godal v0.0.18 @@ -16,8 +16,8 @@ require ( github.com/pressly/goose/v3 v3.27.1 github.com/rabbitmq/amqp091-go v1.13.0 github.com/spf13/cobra v1.10.2 - golang.org/x/sync v0.22.0 - golang.org/x/text v0.41.0 + golang.org/x/sync v0.23.0 + golang.org/x/text v0.42.0 modernc.org/sqlite v1.53.0 ) @@ -51,9 +51,9 @@ require ( github.com/zeebo/xxh3 v1.1.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect - golang.org/x/crypto v0.56.0 // indirect - golang.org/x/net v0.57.0 // indirect - golang.org/x/sys v0.47.0 // indirect + golang.org/x/crypto v0.57.0 // indirect + golang.org/x/net v0.60.0 // indirect + golang.org/x/sys v0.48.0 // indirect google.golang.org/protobuf v1.36.12 // indirect gopkg.in/ini.v1 v1.67.2 // indirect modernc.org/libc v1.73.4 // indirect diff --git a/go.sum b/go.sum index 63f7c0b..069feea 100644 --- a/go.sum +++ b/go.sum @@ -174,24 +174,24 @@ go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN8 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= -golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y= -golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I= -golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= -golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= -golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= -golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc= golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8= -golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= -golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= -golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4= golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= -golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= -golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= google.golang.org/api v0.224.0 h1:Ir4UPtDsNiwIOHdExr3fAj4xZ42QjK7uQte3lORLJwU= google.golang.org/api v0.224.0/go.mod h1:3V39my2xAGkodXy0vEqcEtkqgw2GtrFL5WuBZlCTCOQ= google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb h1:ITgPrl429bc6+2ZraNSzMDk3I95nmQln2fuPstKwFDE=