From 6db8bf8d805b34663a08cb7ae5d12a541d8b100a Mon Sep 17 00:00:00 2001 From: Pujitha Paladugu Date: Sun, 18 Oct 2026 22:02:04 -0700 Subject: [PATCH] build(deps): bump golang.org/x/net from 0.59.0 to 0.60.0 (#8661) Motivation: golang.org/x/net before v0.60.0 is affected by GO-2026-6612 (HTTP/2 server can refund connection-level flow control twice, allowing a client to bypass MaxReceiveBufferPerConnection; total buffered data remains bounded by the stream limit and stream-level flow control). CoreDNS uses the x/net HTTP/2 stack for DoH/DoH3-related serving paths and downstream scanners flag the dependency version. Approach: go get golang.org/x/net@v0.60.0 and go mod tidy. Only go.mod and go.sum change (one module, no transitive changes). Validation: ran `go build ./...` and `go test ./plugin/https/... ./plugin/grpc/... ./core/...`; all passed. This does not exercise the vulnerability itself; it only shows the bump builds and the HTTP/2-using packages' tests still pass. The standard-library part of the fix and any patch release depend on the Go toolchain used for release builds, which this change does not alter. Report: https://github.com/coredns/coredns/issues/8656 Assisted-by: claude-sonnet-5-5 (via Claude Code) Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index f07f5091e..a0aeb72e2 100644 --- a/go.mod +++ b/go.mod @@ -58,7 +58,7 @@ require ( github.com/pires/go-proxyproto v0.15.0 github.com/prometheus/exporter-toolkit v0.20.0 go.uber.org/zap v1.28.0 - golang.org/x/net v0.59.0 + golang.org/x/net v0.60.0 ) require ( diff --git a/go.sum b/go.sum index 865965433..c99c6a2e6 100644 --- a/go.sum +++ b/go.sum @@ -490,8 +490,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qx golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=