Repository navigation
fix(deps): Go 1.27.2 and x/net v0.60.0 (GO-2026-6612/6613/6617) - #315
Merged
Merged
Conversation
…13/6617 govulncheck started failing every build on 2026-10-09: three new advisories reach Shepherd's code — GO-2026-6617 (HTTP/2 server crash, HPACK encoder race; net/http and x/net), GO-2026-6613 (HTTP/1 desync after a 2xx CONNECT) and GO-2026-6612 (HTTP/2 double flow-control refund). Fixed in Go 1.27.2 and x/net v0.60.0. go.mod moves to go 1.27.2 and x/net v0.60.0 (nothing else moves; grpc stays held at v1.83.2). GO_IMAGE's golang:1.27-alpine digest is refreshed to the 1.27.2 build (verified: go version go1.27.2) in versions.env, the Dockerfile ARG defaults and e2e/mockmsft. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BPMsuQQBnedAsJ8tJMH3rw
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every PR's required
buildstarted failing atgovulnchecktoday (2026-10-09). Three new advisories are reachable from Shepherd's code:http2.ConfigureTransports, and the mcp round-tripper.Fixed in Go 1.27.2 and
golang.org/x/netv0.60.0.go.mod:go 1.27.2, x/net v0.60.0. Nothing else moves; grpc stays held at v1.83.2 and otlp at v1.11.0.GO_IMAGEgolang:1.27-alpinedigest refreshed to the 1.27.2 build (go version go1.27.2checked in the image) inversions.env, the three Dockerfile ARG defaults ande2e/mockmsft/Dockerfile.Local checks:
go build,go vet, govulncheck (no reachable vulnerabilities),make check-docker, repocheck.CHANGELOG (v0.15.0, Changed): Built with Go 1.27.2 and golang.org/x/net v0.60.0, which fix GO-2026-6612, GO-2026-6613 and GO-2026-6617 (net/http and HTTP/2).
🤖 Generated with Claude Code
https://claude.ai/code/session_01BPMsuQQBnedAsJ8tJMH3rw