chore(deps): bump golang.org/x/text to v0.39.0 and golang.org/x/net to v0.56.0 (CVE-2026-56852, CVE-2026-46600) - #24
Merged
Conversation
…o v0.56.0 Remediates: - CVE-2026-56852 (HIGH) in golang.org/x/text: v0.37.0 -> v0.39.0 - CVE-2026-46600 (severity unknown) in golang.org/x/net: v0.55.0 -> v0.56.0 Applied to the root module and to nodebuilder/tests/tastora. Reported by Pipeline / CVE - Trigger run 30995014323. Signed-off-by: David Wertenteil <david.wertenteil@kaleido.io>
dwertent
added
cve-management
security
dependencies
There was a problem hiding this comment.
Pull request overview
This PR updates Go module dependencies on the release-v0.28.4 branch to remediate reported CVEs by bumping golang.org/x/text and golang.org/x/net (and the required golang.org/x/* transitive closure) across the repository’s root module and the nodebuilder/tests/tastora module.
Changes:
- Root module: bump
golang.org/x/texttov0.39.0andgolang.org/x/nettov0.56.0, plus associatedgolang.org/x/*versions required by MVS. - Tastora module: updates
golang.org/x/text/golang.org/x/netand refreshesgo.sumentries to match resolved versions. - Updates
go.sumfiles to reflect the new module graph checksums.
Reviewed changes
Copilot reviewed 2 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| go.mod | Bumps golang.org/x/text and related golang.org/x/* versions in the root module (including x/net indirectly). |
| go.sum | Updates root module checksums for the updated golang.org/x/* dependency set. |
| nodebuilder/tests/tastora/go.mod | Updates dependencies for the tastora test module (intended to include the x/text/x/net bumps). |
| nodebuilder/tests/tastora/go.sum | Updates tastora module checksums corresponding to the updated dependency graph. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Completes the CVE set on this branch (GHSA-hrxh-6v49-42gf) and regenerates nodebuilder/tests/tastora/go.sum so go-mod-tidy CI is clean. Signed-off-by: David Wertenteil <david.wertenteil@kaleido.io>
Brindrajsinh-Chauhan
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CVE remediation for the
release-v0.28.4branch, which is the authoritative image build pin for the Celestia node image in App Cloud. The fix must land on this branch to reach the built image.Dependency changes
golang.org/x/textgolang.org/x/netApplied to both modules in the repo:
go.mod(x/textis a direct require,x/netindirect)nodebuilder/tests/tastora/go.mod(both indirect)The root module also picks up the transitive
golang.org/x/*closure that MVS requires forx/net v0.56.0/x/text v0.39.0(x/crypto,x/mod,x/sync,x/sys,x/telemetry,x/term,x/tools). No non-golang.org/xmodule versions change.Relationship to Dependabot PR #23
Dependabot PR #23 on this same base branch bumps
google.golang.org/grpc1.81.1 -> 1.82.1 (root + tastora). This PR deliberately does not touch grpc so the two do not collide — #23 should be merged alongside this PR to get full coverage.One note for the reviewer:
nodebuilder/tests/tastora/go.modis not tidy on the base branch — runninggo mod tidythere with no other change rewrites ~50 lines and would move grpc to 1.81.1, conflicting with #23. To avoid that, the tastora bump was made withgo mod edit+go mod downloadrather thango mod tidy, keeping the diff to exactly the two target lines. The pre-existing untidiness is left alone and is worth a separate cleanup PR.Verification
go build ./...in the root module: exit 0go vet ./...innodebuilder/tests/tastora(type-checks test files too): exit 0go.modfilesmake vulnchecktarget exists in this repogo.mod/go.sumare modified; no source or artifact changesProvenance
Reported by Pipeline / CVE - Trigger run 30995014323 (https://github.com/kaleido-io/kaleido-app-cloud/actions/runs/30995014323)