Repository navigation
Update golang.org/x/net in the Go reference app and except GO-2026-5932 - #365
Merged
Merged
Conversation
Trivy reported five advisories against golang.org/x/net v0.58.0 (CVE-2026-78669 high; CVE-2026-78663 and CVE-2026-97032 medium; CVE-2026-78659 and CVE-2026-78660 unrated), all fixed in 0.60.0. `go get golang.org/x/net@v0.61.0`, the newest release, also raises golang.org/x/crypto to v0.58.0, x/sync to v0.24.0, x/sys to v0.49.0 and x/text to v0.43.0. osv.dev lists no advisories for x/net 0.61.0, x/sync 0.24.0, x/sys 0.49.0 or x/text 0.43.0. The sixth alert, GO-2026-5932, has no fixed version: it marks the golang.org/x/crypto/openpgp packages as unmaintained in every release of x/crypto, including v0.58.0. `go mod why golang.org/x/crypto/openpgp` reports that the main module does not need the package. The entry in .trivyignore.yaml says so, scoped to reference-apps/golang/go.mod and expiring 2027-01-15, and the repository scan in security.yml now reads that file. Trivy 0.74.0 on this tree reports GO-2026-5932 as the only vulnerability without the file and none with it. `go build ./...`, `go vet ./...` and `go test ./...` pass. The detect-secrets baseline moves one line number in security.yml.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the Trivy alerts on
reference-apps/golang/go.mod..trivyignore.yamlentry, expires 2027-01-15go get golang.org/x/net@v0.61.0also raises x/crypto 0.56.0 → 0.58.0, x/sync 0.22.0 → 0.24.0, x/sys 0.48.0 → 0.49.0, x/text 0.41.0 → 0.43.0. osv.dev (queried 2026-10-15) lists no advisories for x/net 0.61.0, x/sync 0.24.0, x/sys 0.49.0, x/text 0.43.0; for x/crypto 0.58.0 it lists only GO-2026-5932.golang.org/x/crypto/openpgpas unmaintained.go mod why golang.org/x/crypto/openpgpreports "main module does not need package". The exception is scoped toreference-apps/golang/go.mod, and the Trivy repository scan now reads.trivyignore.yamlthrough the action'strivyignoresinput.go 1.26.0in go.mod,golang:1.27-alpinein the Dockerfile) is unchanged.Checks:
go build ./...,go vet ./...,go test ./...pass. Trivy 0.74.0fs .on this branch reports GO-2026-5932 as the only vulnerability without the ignore file and none with it. The pre-commit hooks pass on the changed files; detect-secrets moved one baseline line number in security.yml.