Skip to content

chore: resolve open dependabot security alerts#49

Merged
jonathannorris merged 2 commits into
mainfrom
chore/dependabot-alerts
Jul 20, 2026
Merged

chore: resolve open dependabot security alerts#49
jonathannorris merged 2 commits into
mainfrom
chore/dependabot-alerts

Conversation

@jonathannorris

@jonathannorris jonathannorris commented Jul 10, 2026

Copy link
Copy Markdown
Member

Summary

  • Resolved 7 critical, 2 high, and 5 medium Dependabot security alerts by upgrading golang.org/x/crypto and golang.org/x/net
  • Updated Go minimum version (go directive) from 1.24.0 to 1.25.0 (required by the updated dependency versions; CI already uses go-version: stable)

Dependabot Alerts Resolved

Alert Package Severity Fix
#32 golang.org/x/crypto critical Bumped v0.45.0 -> v0.54.0
#30 golang.org/x/crypto critical Bumped v0.45.0 -> v0.54.0
#29 golang.org/x/crypto critical Bumped v0.45.0 -> v0.54.0
#27 golang.org/x/crypto critical Bumped v0.45.0 -> v0.54.0
#25 golang.org/x/crypto critical Bumped v0.45.0 -> v0.54.0
#24 golang.org/x/crypto critical Bumped v0.45.0 -> v0.54.0
#21 golang.org/x/crypto critical Bumped v0.45.0 -> v0.54.0
#26 golang.org/x/crypto high Bumped v0.45.0 -> v0.54.0
#23 golang.org/x/crypto high Bumped v0.45.0 -> v0.54.0
#33 golang.org/x/crypto medium Bumped v0.45.0 -> v0.54.0
#31 golang.org/x/crypto medium Bumped v0.45.0 -> v0.54.0
#28 golang.org/x/crypto medium Bumped v0.45.0 -> v0.54.0
#22 golang.org/x/crypto medium Bumped v0.45.0 -> v0.54.0
#20 golang.org/x/net medium Bumped v0.47.0 -> v0.57.0

Verification

  • go build ./... passes
  • go test -v -race ./... passes (all 7 subtests)

- golang.org/x/crypto v0.45.0 -> v0.54.0 (critical/high/medium, alerts #21 #24 #25 #27 #29 #30 #32 #31 #28 #26 #22)
- golang.org/x/net v0.47.0 -> v0.57.0 (medium, alert #20)
- golang.org/x/sys v0.38.0 -> v0.47.0 (transitive)
- golang.org/x/text v0.31.0 -> v0.40.0 (transitive)
Copilot AI review requested due to automatic review settings July 10, 2026 13:39
@jonathannorris
jonathannorris requested a review from a team as a code owner July 10, 2026 13:39

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses Dependabot security alerts by upgrading golang.org/x/crypto and golang.org/x/net, and updates the Go version declared in go.mod to align with the newer dependency requirements.

Changes:

  • Bump golang.org/x/crypto to v0.54.0 and golang.org/x/net to v0.57.0 (plus related indirect x/sys and x/text bumps).
  • Update go.mod go directive from 1.24.0 to 1.25.0.
  • Refresh go.sum accordingly.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File Description
go.mod Updates the Go version directive and bumps golang.org/x/* indirect dependencies.
go.sum Updates module checksums to reflect the new golang.org/x/* versions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread go.mod
@JamieSinn

Copy link
Copy Markdown
Member

@jonathannorris you'll also need to update the github actions for this to run properly.

i recommend we set the version to stable not a specific version

- Upgrade Dockerfile base image golang:1.24 -> golang:1.25 (required by go.mod go 1.25.0 directive)
- Update golangci-lint-action v3 -> v8 to support Go 1.25+ (v1.64.8 was built with Go 1.24)
- Remove --sort-results flag (removed in golangci-lint v2)
- Add //nolint:errcheck to defer X.Close() patterns (v2 reports these; v1 excluded by default)
- Lowercase error string in options.go to fix ST1005
- Discard return value of pretty.Println in test to fix errcheck
@jonathannorris
jonathannorris enabled auto-merge (squash) July 10, 2026 13:48
@jonathannorris
jonathannorris merged commit a298d94 into main Jul 20, 2026
6 checks passed
@jonathannorris
jonathannorris deleted the chore/dependabot-alerts branch July 20, 2026 13:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants