Pujitha Paladugu 6db8bf8d80 build(deps): bump golang.org/x/net from 0.59.0 to 0.60.0 (#8661) ...

Motivation: golang.org/x/net before v0.60.0 is affected by GO-2026-6612
(HTTP/2 server can refund connection-level flow control twice, allowing a
client to bypass MaxReceiveBufferPerConnection; total buffered data remains
bounded by the stream limit and stream-level flow control). CoreDNS uses the
x/net HTTP/2 stack for DoH/DoH3-related serving paths and downstream
scanners flag the dependency version.

Approach: go get golang.org/x/net@v0.60.0 and go mod tidy. Only go.mod and
go.sum change (one module, no transitive changes).

Validation: ran `go build ./...` and
`go test ./plugin/https/... ./plugin/grpc/... ./core/...`; all passed.
This does not exercise the vulnerability itself; it only shows the bump
builds and the HTTP/2-using packages' tests still pass. The standard-library
part of the fix and any patch release depend on the Go toolchain used for
release builds, which this change does not alter.

Report: https://github.com/coredns/coredns/issues/8656

Assisted-by: claude-sonnet-5-5 (via Claude Code)

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>

2026-10-18 22:02:04 -07:00

56 KiB

Raw Blame History

View Raw