Skip to content

fix(security): remediate CVE vulnerabilities - #264

Merged
ulucinar merged 1 commit into
release-0.6from
fix/cve-remediation-release-0.6-20261015-191519
Oct 16, 2026
Merged

ulucinar merged 1 commit into
release-0.6from
fix/cve-remediation-release-0.6-20261015-191519

Conversation

@ulucinar

Copy link
Copy Markdown
Collaborator

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA Severity Package Fixed Version
GO-2026-6612 Critical stdlib 1.26.9
GO-2026-6604 Critical stdlib 1.26.9
GO-2026-6603 High stdlib 1.26.9
GO-2026-6611 High stdlib 1.26.9
GO-2026-6608 High stdlib 1.26.9
GO-2026-6607 High stdlib 1.26.9
GO-2026-6609 High stdlib 1.26.9
GO-2026-6613 High stdlib 1.26.9
GO-2026-6605 High stdlib 1.26.9
GO-2026-6610 High stdlib 1.26.9
GO-2026-6617 Unknown stdlib 1.26.9
GO-2026-6599 Unknown stdlib 1.26.9
GO-2026-6600 Unknown stdlib 1.26.9
GO-2026-6612 Critical golang.org/x/net v0.60.0
GO-2026-6603 High golang.org/x/net v0.60.0
GO-2026-6611 High golang.org/x/net v0.60.0
GO-2026-6610 High golang.org/x/net v0.60.0
GO-2026-6617 Unknown golang.org/x/net v0.60.0

Changes Made

  • Updated `go` directive in go.mod from 1.25.13 to 1.26.9
  • Updated golang.org/x/net from v0.58.0 to v0.60.0
  • Updated GO_VERSION in .github/workflows/ci.yml to 1.26.9
  • Ran `go mod tidy` to update transitive dependencies

References

Verification

  • Rescanned with `cve-scan` skill after fixes
  • All listed vulnerabilities resolved

- Update Go version to 1.26.9 (fixes 13 stdlib CVEs including GO-2026-6612, GO-2026-6604)
- Update golang.org/x/net to v0.60.0 (fixes 5 CVEs including GO-2026-6612, GO-2026-6603)
- Update CI workflow Go version to 1.26.9

Resolves 19 CVE vulnerabilities (2 Critical, 12 High, 5 Unknown severity).

Signed-off-by: Alper Rifat Ulucinar <ulucinar@users.noreply.github.com>

@sergenyalcin sergenyalcin left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @ulucinar LGTM!

@ulucinar
ulucinar merged commit bf84ab0 into release-0.6 Oct 16, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants