From dc6e398c6a822e23ed79983c1ba0865c06932158 Mon Sep 17 00:00:00 2001 From: JeanExtreme002 Date: Tue, 3 Nov 2026 10:57:02 -0300 Subject: [PATCH] fix(go): bump golang.org/x/net to v0.62.0 for GO-2026-6860 govulncheck fails the Go Package workflow on 1.27.x because golang.org/x/net v0.61.0 is affected by GO-2026-6860 (quadratic complexity when coalescing text nodes in html), reached through parseAirlinesHTML -> html.Parse. v0.62.0 ships the fix. Co-Authored-By: Claude Fable 5.1 --- go/go.mod | 2 +- go/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go/go.mod b/go/go.mod index 5334888..79d19fc 100644 --- a/go/go.mod +++ b/go/go.mod @@ -4,6 +4,6 @@ go 1.26.0 require ( github.com/andybalholm/brotli v1.2.2 - golang.org/x/net v0.61.0 + golang.org/x/net v0.62.0 golang.org/x/text v0.43.0 ) diff --git a/go/go.sum b/go/go.sum index 20f6b83..45956a4 100644 --- a/go/go.sum +++ b/go/go.sum @@ -2,7 +2,7 @@ github.com/andybalholm/brotli v1.2.2 h1:HzTuoo2ErYQqf5qvcJInB8uvqSVxRttzkFexPWtn github.com/andybalholm/brotli v1.2.2/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU= github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E= -golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= -golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=