From 8d3517519fd5cfa24228f794c33c4351c4e17d0a Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 27 Jul 2026 13:03:12 +0300 Subject: [PATCH] fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970) (#1481) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Problem The **Build, Lint, and Validate** CI job is failing on every open PR (#1480, #1474, #1449) and on `main`. The failing step is `govulncheck`: ``` Vulnerability #1: GO-2026-5970 Infinite loop on invalid input in golang.org/x/text Found in: golang.org/x/text@v0.38.0 Fixed in: golang.org/x/text@v0.39.0 ``` This is **not** caused by any of those PRs' changes — `govulncheck-action` fetches the live vulnerability database at runtime, so when GO-2026-5970 was published, every branch based on the current `main` started failing. The vulnerable symbol is reachable via: - `auth.DefaultHTTPKeyFetcher.FetchKey` → `http.Client.Do` - `database.NewTestDB` → `pgx.Connect` so the scan exits with code 3. ## Fix Bump the (indirect) `golang.org/x/text` dependency from `v0.38.0` to the fixed `v0.39.0` and `go mod tidy`. ## Verification - `govulncheck ./...` no longer reports GO-2026-5970 (confirmed locally). - `go build ./...` passes. ## Note The `deploy/` module pins `golang.org/x/text@v0.37.0`, which is also < v0.39.0. It is a separate module and is **not** scanned by this CI job (govulncheck runs `./...` in the root module only), so it does not block CI. Worth a follow-up bump for hygiene, but out of scope here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index deca776..20927f2 100644 --- a/go.mod +++ b/go.mod @@ -75,7 +75,7 @@ require ( golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.21.0 // indirect golang.org/x/sys v0.46.0 // indirect - golang.org/x/text v0.38.0 // indirect + golang.org/x/text v0.39.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.287.1 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect diff --git a/go.sum b/go.sum index 82ba632..91d94ad 100644 --- a/go.sum +++ b/go.sum @@ -174,8 +174,8 @@ golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus= +golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=