From d098dfd4b597944f65d8f5d93a57ab41c12dab2e Mon Sep 17 00:00:00 2001 From: Daniel Raper Date: Wed, 19 Aug 2026 14:18:09 +0100 Subject: [PATCH] Bump golang.org/x/mod to v0.40.0 to fix CVEs Resolves CVE-2026-56864 and CVE-2026-56865. x/mod v0.37.0 was pulled in indirectly by the two Fabric chaincode modules and the assetcreator test contract; all three now require v0.40.0. Signed-off-by: Daniel Raper --- smart_contracts/fabric/custompin-sample/go.mod | 2 +- smart_contracts/fabric/custompin-sample/go.sum | 4 ++-- smart_contracts/fabric/firefly-go/go.mod | 2 +- smart_contracts/fabric/firefly-go/go.sum | 4 ++-- test/data/contracts/assetcreator/go.mod | 2 +- test/data/contracts/assetcreator/go.sum | 4 ++-- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/smart_contracts/fabric/custompin-sample/go.mod b/smart_contracts/fabric/custompin-sample/go.mod index 9a50a06fe..dff8f7fac 100644 --- a/smart_contracts/fabric/custompin-sample/go.mod +++ b/smart_contracts/fabric/custompin-sample/go.mod @@ -37,7 +37,7 @@ require ( require ( github.com/golang/protobuf v1.5.4 github.com/josharian/intern v1.0.0 // indirect - golang.org/x/mod v0.37.0 // indirect + golang.org/x/mod v0.40.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/smart_contracts/fabric/custompin-sample/go.sum b/smart_contracts/fabric/custompin-sample/go.sum index 3a093d079..5d4cbd3ec 100644 --- a/smart_contracts/fabric/custompin-sample/go.sum +++ b/smart_contracts/fabric/custompin-sample/go.sum @@ -117,8 +117,8 @@ go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLh golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190621222207-cc06ce4a13d4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= +golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= diff --git a/smart_contracts/fabric/firefly-go/go.mod b/smart_contracts/fabric/firefly-go/go.mod index 11d8bf725..c25a0a253 100644 --- a/smart_contracts/fabric/firefly-go/go.mod +++ b/smart_contracts/fabric/firefly-go/go.mod @@ -29,7 +29,7 @@ require ( github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect - golang.org/x/mod v0.37.0 // indirect + golang.org/x/mod v0.40.0 // indirect golang.org/x/net v0.56.0 // indirect golang.org/x/sys v0.46.0 // indirect golang.org/x/text v0.39.0 // indirect diff --git a/smart_contracts/fabric/firefly-go/go.sum b/smart_contracts/fabric/firefly-go/go.sum index 3a093d079..5d4cbd3ec 100644 --- a/smart_contracts/fabric/firefly-go/go.sum +++ b/smart_contracts/fabric/firefly-go/go.sum @@ -117,8 +117,8 @@ go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLh golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190621222207-cc06ce4a13d4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= +golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= diff --git a/test/data/contracts/assetcreator/go.mod b/test/data/contracts/assetcreator/go.mod index 71e45b58c..d35f84fbc 100644 --- a/test/data/contracts/assetcreator/go.mod +++ b/test/data/contracts/assetcreator/go.mod @@ -24,7 +24,7 @@ require ( github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xeipuuv/gojsonschema v1.2.0 // indirect - golang.org/x/mod v0.37.0 // indirect + golang.org/x/mod v0.40.0 // indirect golang.org/x/net v0.56.0 // indirect golang.org/x/sys v0.46.0 // indirect golang.org/x/text v0.39.0 // indirect diff --git a/test/data/contracts/assetcreator/go.sum b/test/data/contracts/assetcreator/go.sum index 3a093d079..5d4cbd3ec 100644 --- a/test/data/contracts/assetcreator/go.sum +++ b/test/data/contracts/assetcreator/go.sum @@ -117,8 +117,8 @@ go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLh golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20190621222207-cc06ce4a13d4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= +golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=