chore(deps): bump golang.org/x/term from 0.43.0 to 0.45.0 - #655
Closed
dependabot[bot] wants to merge 5 commits into
Closed
chore(deps): bump golang.org/x/term from 0.43.0 to 0.45.0#655dependabot[bot] wants to merge 5 commits into
dependabot[bot] wants to merge 5 commits into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
dosubot
Bot
added
the
size:XS
![mergify[bot]](https://webproxy.poorya-velaei-d67.workers.dev/https://avatars.githubusercontent.com/in/10562?s=60&v=4){kind=small}
Contributor
Merge Protections🟢 All 3 merge protections satisfied — ready to merge. Show 3 satisfied protections🟢 Full CI must passAll CI checks must pass. Activates for non-bot authors, or dependabot when files exist outside .github/workflows/.
🟢 Do not merge outdated PRsMake sure PRs are within 10 commits of the base branch before merging
🟢 🚦 Auto-queueWhen all merge protections are satisfied and these conditions match, this pull request will be queued automatically.
|
3 tasks
Member
|
@dependabot recreate |
dependabot
Bot
force-pushed
the
dependabot/go_modules/golang.org/x/term-0.44.0
branch
from
June 24, 2026 02:17
bc18137 to
f767c20
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Contributor
Merge Queue Status
This pull request spent 8 minutes 13 seconds in the queue, with no time running CI. ReasonPull request #655 has been dequeued Queue conditions are not satisfied:
HintYou should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it. Requeued — the merge queue status continues in this comment ↓. |
mergify Bot
pushed a commit
that referenced
this pull request
Jun 24, 2026
…abot coverage (#656) ## Summary What began as unblocking three stale Dependabot PRs (#653, #654, #655) uncovered a masked security exposure. Three changes: 1. **Fix the govulncheck crash** (was hiding real findings) 2. **Remediate the two stdlib CVEs** the working scanner then surfaced 3. **Unblock Dependabot coverage uploads** ### 1. govulncheck crash → pin to v1.3.0 `security.yml` installed `govulncheck@latest` = **v1.4.0**, which bundles `golang.org/x/tools v0.46.0`, whose `typesinternal.ForEachElement` panics (`called on type containing *types.TypeParam`) on this module's generics — aborting the scan with exit 2. It failed on every PR **and** `main`'s scheduled run. Pinned to **v1.3.0** (bundles `x/tools v0.44.0`, predates the bug). The vuln DB is fetched at runtime, so scan coverage is unchanged. ### 2. Real stdlib vulnerabilities → bump Go toolchain to 1.26.4 Once it stopped crashing, govulncheck reported **2 standard-library vulnerabilities this code reaches** (previously hidden by the crash): | ID | Package | Reached via | Fixed in | |----|---------|-------------|----------| | **GO-2026-5039** | `net/textproto` — unescaped input in errors | `sanitizer.SanitizeXML` → `io.ReadAll` → `textproto.Reader.ReadMIMEHeader` | go1.26.4 | | **GO-2026-5037** | `crypto/x509` — inefficient hostname parsing | `x509.Certificate.Verify`/`VerifyHostname`, `HostnameError.Error` | go1.26.4 | Bumped the **`go.mod` toolchain** (read by the govulncheck job via `go-version-file`) and the **mise pin** (drives local dev + release builds, so shipped binaries link the patched stdlib) from 1.26.2/1.26.3 → **1.26.4**. `mise.lock` regenerated across all 11 platforms. The newer toolchain taught `gopls modernize` about Go 1.26 stdlib APIs, which flagged pre-existing code; applied those to keep lint green (`errors.As` → `errors.AsType[*T]` in cfgparser; `sync/atomic` int32 → `atomic.Int32` in a processor test). No behavior change. ### 3. Coverage hard-fail on Dependabot PRs Dependabot PRs lack `CODECOV_TOKEN`, so the tokenless upload to a protected branch is rejected (`Token required because branch is protected`), and `fail_ci_if_error: true` failed the whole job. `fail_ci_if_error` now stays `true` for everyone except `dependabot[bot]`; coverage tests still run and gate the job regardless of actor. ## Verification - Reproduced locally: `govulncheck@v1.4.0` panics; `@v1.3.0` runs clean. - Against the **1.26.4** stdlib, pinned govulncheck reports `No vulnerabilities found.` (exit 0) — both CVEs cleared. - Confirmed dependency delta via each release's `go.mod` (v1.4.0 → x/tools v0.46.0; v1.3.0 → v0.44.0). - `just ci-check` passes (lint + modernize + full test suite); `actionlint` clean. ## Test plan - [ ] CI green on this PR (govulncheck + Coverage are the jobs under test). - [ ] After merge, rebase #653/#654/#655 and confirm their blocking checks clear. - [ ] Confirm the next scheduled Security run on `main` passes. --- Used Claude Code (Claude Opus 4.8) to triage the failures and draft the fix. All changes reviewed and verified. See [AI_POLICY.md](../blob/main/AI_POLICY.md). --------- Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Contributor
Author
|
A newer version of golang.org/x/term exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
3 tasks
unclesp1d3r
added a commit
that referenced
this pull request
Jul 17, 2026
## Summary govulncheck is failing the Security workflow on every open PR (#682, #681, #680, #655) because GO-2026-5856 — a crypto/tls Encrypted Client Hello privacy leak in the Go standard library — is reachable from `sanitizer.SanitizeXML` via `io.ReadAll` and is present in go1.26.4. The fix shipped in go1.26.5. ## Changes - Bump `go.mod` toolchain from go1.26.4 to go1.26.5 - Bump the `mise.toml` Go pin (and `mise.lock`) to match - Migrate the `errors.As` call in `internal/config/config.go` to Go 1.26's `errors.AsType`, flagged by the modernize pass under the new toolchain. The intentionally discarded match value carries a targeted, explained `//nolint:errcheck` (the repo enables `check-blank`); no linter configuration was changed. ## Test plan - [x] `just ci-check` passes locally (lint, modernize, tests, race detector) - [x] `govulncheck ./...` reports no vulnerabilities under go1.26.5 - [ ] CI Security workflow green on this PR ## AI Disclosure Used Claude Code (Fable 5) to diagnose the govulncheck failure and draft this change. All changes reviewed and verified locally per [AI_POLICY.md](https://github.com/EvilBit-Labs/opnDossier/blob/main/AI_POLICY.md). Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
Member
|
@dependabot rebase |
Contributor
Author
|
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry! If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request |
unclesp1d3r
previously approved these changes
Jul 17, 2026
Member
|
@Mergifyio requeue |
Contributor
Merge Queue Status
Waiting for
All conditions
|
Member
|
@dependabot recreate |
Bumps [golang.org/x/term](https://github.com/golang/term) from 0.43.0 to 0.45.0. - [Commits](golang/term@v0.43.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/go_modules/golang.org/x/term-0.44.0
branch
from
July 17, 2026 02:57
6693aaf to
e7ed54b
Compare
Member
|
@mergify queue |
Contributor
☑️ Command
|
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/go_modules/golang.org/x/term-0.44.0
branch
July 17, 2026 03:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps golang.org/x/term from 0.43.0 to 0.45.0.
Commits
9f69229go.mod: update golang.org/x dependencies3b43943go.mod: update golang.org/x dependencies