mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-11-02 17:33:47 +00:00
xarmian
6dfc431402
* fix(deps): bump golang.org/x/net to v0.62.0 for GO-2026-6866 and GO-2026-6860 (TASK-4115) govulncheck fails the Go and Nix CI gates on every PR. golang.org/x/net v0.61.0 (indirect) has two advisories, and pad's code reaches both: GO-2026-6866 (html.Render does not check every ancestor namespace transition when rendering raw text) and GO-2026-6860 (html.Parse/ParseWithOptions take quadratic time when coalescing text nodes). Both are fixed in v0.62.0, published 2026-10-27T19:00:16Z, after main last went green. go get golang.org/x/net@v0.62.0, then go mod tidy. Only x/net moves: one go.mod line and two go.sum pairs. No other module changes. govulncheck -mode binary on cmd/pad built from this tree reports "Your code is affected by 0 vulnerabilities", exit 0. The control, the same scan on a base build (x/net v0.61.0), reports both advisories, exit 3. v0.62.0 is younger than the 7-day dependency-age threshold, so it is allow-listed in .github/dep-age-allow.txt as a security fix citing both advisories. The nix vendorHash follows from the PR's Nix job. Claude-Session: https://claude.ai/code/session_01Pa22hK3vXbxQYYyvvvRGYL * chore(nix): vendorHash for golang.org/x/net v0.62.0 (TASK-4115) Taken from the got: line of this PR's Nix job (job 122632750043, 04:34:55Z): specified sha256-uEIFUop7X4VHmbICrH6CW7SL1GB4tjmIIcHGKLkYmUU=, got sha256-ykiFPHwGu7Lr4NSJs45HuKj7rqfsBDUKtjiCTDfYkiA=. The job recomputes the hash before building, so its green result alone did not show the committed value was current (CONVE-3888). Claude-Session: https://claude.ai/code/session_01Pa22hK3vXbxQYYyvvvRGYL