Bump golang.org/x/net to v0.60.0 for GO-2026-6617
Finding
golang.org/x/net v0.59.0 carries five advisories, all fixed in v0.60.0:
| ID | Summary |
|---|---|
| GO-2026-6617 / CVE-2026-78669 (HIGH) | A peer opens many HTTP/2 streams, then sends many small SETTINGS frames, and burns the CPU |
| GO-2026-6612 | Double flow-control refund on HTTP/2 server streams |
| GO-2026-6611 | Excessive CPU from repeated initial window changes |
| GO-2026-6610 | HTTP/2 transport accepts malformed framing headers |
| GO-2026-6603 | HTTP/2 server memory exhaustion via Trailer headers |
govulncheck finds the CLI calling the affected code (for example through internal/connector/driver/worker.go:339 and internal/connector/setup/checks.go:456). Trivy fails Trivy Security Scan on the HIGH one. Both checks went red on main without a code change, when the advisory database picked these up.
Fix
golang.org/x/netv0.59.0 → v0.60.0.go mod tidymoved nothing else.nix/package.nix: a newvendorHashfor the newgo.sum.make update-nix-hashrecomputed it and verified the flake builds in Docker.
Proof
- Trivy 0.70.0 (the version trivy-action v0.36.0 runs),
fs --severity HIGH,CRITICAL --ignore-unfixed:mainhas 1 HIGH finding (golang.org/x/netCVE-2026-78669). This branch has 0. govulncheck -tags dev ./...under Go 1.26.7: onmain, GO-2026-6617, 6612, 6611, 6610 and 6603 are found ingolang.org/x/net@v0.59.0. On this branch, x/net is no longer listed.bin/cipasses locally.
Not fixed here: the required Security check stays red
The same govulncheck run also reports 11 Go standard library advisories in Go 1.26.7, fixed in Go 1.26.9. So Security stays red on this PR until the Go toolchain moves. That fix is #881 ("Build with Go 1.26.9 for eleven standard-library advisories"), stacked on this one. The two have to reach main together.
Merge order: merge #881 into this branch first. This PR then holds both commits and goes green. Then rebase-merge this PR into main.