fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970) - #1481
Merged
Conversation
govulncheck in the "Build, Lint, and Validate" CI job fails on every open PR (and on main) because golang.org/x/text@v0.38.0 is affected by GO-2026-5970 (infinite loop on invalid input). The vulnerable symbol is reachable via auth.DefaultHTTPKeyFetcher.FetchKey -> http.Client.Do and database.NewTestDB -> pgx.Connect, so the scan exits non-zero. Bumping the (indirect) dependency to the fixed v0.39.0 clears the finding. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the root Go module’s indirect dependency on golang.org/x/text to resolve govulncheck failures caused by the newly published vulnerability GO-2026-5970, restoring CI signal on main and open PRs.
Changes:
- Bump
golang.org/x/textfromv0.38.0tov0.39.0in the rootgo.mod(indirect dependency). - Update
go.sumentries to match the new module version/hashes after tidy.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| go.mod | Updates the root module’s indirect golang.org/x/text requirement to v0.39.0 to remediate GO-2026-5970. |
| go.sum | Refreshes dependency checksums to reflect golang.org/x/text@v0.39.0. |
rdimitrov
added a commit
that referenced
this pull request
Jul 27, 2026
Consolidates the five open dependabot PRs into a single change so they can be reviewed and merged together. Each bump was reproduced against current `main` (`go get` + `go mod tidy` for Go modules; the exact SHA pins applied for the actions group), rather than merging the individual branches, to avoid stale `go.sum` conflicts. ## Root module (`go.mod`) | Dependency | From | To | Supersedes | |---|---|---|---| | `google.golang.org/grpc` | 1.82.0 | 1.82.1 | #1479 | | `github.com/prometheus/client_golang` | 1.23.2 | 1.24.1 | #1475 | | `github.com/danielgtaylor/huma/v2` | 2.38.0 | 2.39.0 | #1474 | ## Deploy module (`deploy/go.mod`) | Dependency | From | To | Supersedes | |---|---|---|---| | `github.com/pulumi/pulumi-kubernetes/sdk/v4` | 4.32.0 | 4.33.0 | #1449 | ## GitHub Actions (#1476) - `actions/setup-go` SHA bumped across `ci.yml`, `release.yml`, `deploy-production.yml`, `deploy-staging.yml` - `actions/download-artifact` v4 → v8.0.1 in `close-invalid-publish-prs.yml` `go mod tidy` re-resolved transitive dependencies in both modules accordingly. ## Verification - `go build ./...` passes (root + deploy) - `go vet ./...` passes - `govulncheck ./...` reports no `golang.org/x/text` finding (the GO-2026-5970 fix from #1481 is preserved; tidy pulled x/text to v0.40.0) ## Follow-up Once this merges, the five superseded PRs (#1479, #1475, #1474, #1449, #1476) can be closed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Build, Lint, and Validate CI job is failing on every open PR (#1480, #1474, #1449) and on
main. The failing step isgovulncheck:This is not caused by any of those PRs' changes —
govulncheck-actionfetches the live vulnerability database at runtime, so when GO-2026-5970 was published, every branch based on the currentmainstarted failing. The vulnerable symbol is reachable via:auth.DefaultHTTPKeyFetcher.FetchKey→http.Client.Dodatabase.NewTestDB→pgx.Connectso the scan exits with code 3.
Fix
Bump the (indirect)
golang.org/x/textdependency fromv0.38.0to the fixedv0.39.0andgo mod tidy.Verification
govulncheck ./...no longer reports GO-2026-5970 (confirmed locally).go build ./...passes.Note
The
deploy/module pinsgolang.org/x/text@v0.37.0, which is also < v0.39.0. It is a separate module and is not scanned by this CI job (govulncheck runs./...in the root module only), so it does not block CI. Worth a follow-up bump for hygiene, but out of scope here.🤖 Generated with Claude Code