Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-10-21 01:35:42 -04:00
Code Issues Packages Projects Releases Wiki Activity

build(deps): bump golang.org/x/net from 0.59.0 to 0.60.0 (#8661)

Browse Source 
Motivation: golang.org/x/net before v0.60.0 is affected by GO-2026-6612
(HTTP/2 server can refund connection-level flow control twice, allowing a
client to bypass MaxReceiveBufferPerConnection; total buffered data remains
bounded by the stream limit and stream-level flow control). CoreDNS uses the
x/net HTTP/2 stack for DoH/DoH3-related serving paths and downstream
scanners flag the dependency version.

Approach: go get golang.org/x/net@v0.60.0 and go mod tidy. Only go.mod and
go.sum change (one module, no transitive changes).

Validation: ran `go build ./...` and
`go test ./plugin/https/... ./plugin/grpc/... ./core/...`; all passed.
This does not exercise the vulnerability itself; it only shows the bump
builds and the HTTP/2-using packages' tests still pass. The standard-library
part of the fix and any patch release depend on the Go toolchain used for
release builds, which this change does not alter.

Report: https://github.com/coredns/coredns/issues/8656

Assisted-by: claude-sonnet-5-5 (via Claude Code)

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
This commit is contained in:
Pujitha Paladugu
2026-10-18 22:02:04 -07:00
committed by GitHub
parent 486ceaddd8
commit 6db8bf8d80
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
go.mod
View File

@@ -58,7 +58,7 @@ require (
github.com/pires/go-proxyproto v0.15.0
github.com/prometheus/exporter-toolkit v0.20.0
go.uber.org/zap v1.28.0
golang.org/x/net v0.59.0
golang.org/x/net v0.60.0
)
require (

4
go.sum
View File

@@ -490,8 +490,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=