GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — chore: bump the x group across 1 directory with 8 updates by dependabot[bot] · Pull Request #30772 · coder/coder

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the x group with 8 updates in the / directory:

Package From To
golang.org/x/crypto 0.57.0 0.58.0
golang.org/x/mod 0.41.0 0.42.0
golang.org/x/net 0.59.0 0.60.0
golang.org/x/sync 0.23.0 0.24.0
golang.org/x/sys 0.48.0 0.49.0
golang.org/x/term 0.46.0 0.47.0
golang.org/x/text 0.42.0 0.43.0
golang.org/x/tools 0.50.0 0.51.0

Updates golang.org/x/crypto from 0.57.0 to 0.58.0

Commits
  • 8fdf07b go.mod: update golang.org/x dependencies
  • 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
  • c3db4df acme: prefer test log helpers in test contexts
  • 4e01a84 acme: adds support for profiles draft
  • 8f0f111 ssh: check that no Unicode-aware string function is used
  • b39ff6d ssh: add certificate algorithms for ML-DSA keys
  • 4465db3 ssh: add the ML-DSA public key algorithms
  • 83e695b ssh: implement ETM mode for CBC ciphers
  • 946083a ssh: only drop a trailing carriage return
  • 543dde9 ssh: accept known_hosts entries with a multi-word comment
  • Additional commits viewable in compare view

Updates golang.org/x/mod from 0.41.0 to 0.42.0

Commits
  • b5136e5 sumdb/tlog: use recorded responses in TestCertificateTransparency
  • 1e9a5ae go.mod: update golang.org/x dependencies
  • See full diff in compare view

Updates golang.org/x/net from 0.59.0 to 0.60.0

Commits
  • 18ece0c http2: prevent crash due to HPACK encoder race
  • 2d03f9d http2: avoid 2x refund on stream close with buffered data
  • cc7d34f http2: avoid excessive work on initial window changes
  • 57f4235 http2: apply header limits to Trailer headers too
  • 01e3d03 http2: coalesce dials via wrapped Transport.RoundTrip
  • 2824783 http2: delete malformed framing-related headers
  • b13c0c1 internal/http3: delete HTTP/3 package
  • 520c891 quic: off-path support in loss/congestion/rtt
  • 656874f quic: determine local address for connections
  • a818e16 quic: add a pathAddrs type, holding a local/peer address pair
  • Additional commits viewable in compare view

Updates golang.org/x/sync from 0.23.0 to 0.24.0

Commits
  • 36f2d70 errgroup: modernize the usage of closures in goroutines
  • See full diff in compare view

Updates golang.org/x/sys from 0.48.0 to 0.49.0

Commits
  • b6b8557 unix/linux: unify ppc64x syscall wrappers
  • aab6988 unix: add PrctlArg5Ptr
  • cdfd984 unix: pass fcntl data as unsafe.Pointer in FcntlF{lock,store} on darwin
  • 782b836 unix/linux: don't warn about closed stderr from child process
  • 61592fb unix: return syscall error in *listxattrNS on BSD
  • c136fda unix/linux/Dockerfile: update to Go 1.26.8
  • f1d0d79 unix: pass xattr data as unsafe.Pointer in BSD xattr syscalls
  • 67f850b unix: update linux to v7.2
  • eb1f659 unix: add O_EXEC and O_SEARCH on darwin
  • 51bc731 unix: add Mmsghdr for linux
  • Additional commits viewable in compare view

Updates golang.org/x/term from 0.46.0 to 0.47.0

Commits
  • 0851034 go.mod: update golang.org/x dependencies
  • See full diff in compare view

Updates golang.org/x/text from 0.42.0 to 0.43.0

Commits
  • ac40b0f go.mod: update golang.org/x dependencies
  • 6dcc5b6 unicode/bidi: avoid quadratic behavior in Paragraph.Order and Paragraph.Line
  • d0ecd29 secure/bidirule: lazily precompute ASCII table
  • See full diff in compare view

Updates golang.org/x/tools from 0.50.0 to 0.51.0

Commits
  • ea2f152 go.mod: update golang.org/x dependencies
  • 00443da go/analysis/passes/printf: pin testdata Go versions
  • 9ba0a15 internal/refactor/inline: check import accessibility before Go version
  • 25196fc cmd/toolstash: check -linkobj files to support early export
  • ead0503 gopls/internal/golang: unexport dragon*Question variables
  • 5693030 gopls/internal/golang: call arguments mistreated in inlineAllCalls
  • 134264d gopls/internal/golang/stubmethods: do not panic when FindByPos fails
  • 01d93d7 gopls/internal/golang: slay the dragon: update questions
  • 405de39 go/callgraph: fix benchmarks to analyze whole program
  • 231a7fa go/ssa, cmd/deadcode: release type information once functions are built
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@dependabot
chore: bump the x group across 1 directory with 8 updates
ab822dd 
Bumps the x group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.41.0` | `0.42.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.59.0` | `0.60.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.23.0` | `0.24.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.48.0` | `0.49.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.46.0` | `0.47.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.42.0` | `0.43.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.50.0` | `0.51.0` |



Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `golang.org/x/mod` from 0.41.0 to 0.42.0
- [Commits](golang/mod@v0.41.0...v0.42.0)

Updates `golang.org/x/net` from 0.59.0 to 0.60.0
- [Commits](golang/net@v0.59.0...v0.60.0)

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
- [Commits](golang/sync@v0.23.0...v0.24.0)

Updates `golang.org/x/sys` from 0.48.0 to 0.49.0
- [Commits](golang/sys@v0.48.0...v0.49.0)

Updates `golang.org/x/term` from 0.46.0 to 0.47.0
- [Commits](golang/term@v0.46.0...v0.47.0)

Updates `golang.org/x/text` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.42.0...v0.43.0)

Updates `golang.org/x/tools` from 0.50.0 to 0.51.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.50.0...v0.51.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: x
- dependency-name: golang.org/x/mod
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: x
- dependency-name: golang.org/x/net
  dependency-version: 0.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: x
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: x
- dependency-name: golang.org/x/sys
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: x
- dependency-name: golang.org/x/term
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: x
- dependency-name: golang.org/x/text
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: x
- dependency-name: golang.org/x/tools
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: x
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 14, 2026
github-actions[bot]
github-actions Bot approved these changes Oct 14, 2026
View reviewed changes
@github-actions
github-actions Bot enabled auto-merge (squash) October 14, 2026 17:21
@github-actions
github-actions Bot merged commit 62ea1fd into main Oct 14, 2026
64 of 65 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@github-actions
github-actions Bot deleted the dependabot/go_modules/x-13020c1b31 branch October 14, 2026 17:37
@linear-code

linear-code Bot commented Oct 14, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

ENT-210

ENT-211

ENT-215
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
This was referenced Oct 14, 2026
fix: bump Go version from 1.26.5 to 1.26.9 #30807
Merged
fix: bump Go version from 1.26.5 to 1.26.9 (backport 2.38) #30808
Merged
fix: bump Go version from 1.26.5 to 1.26.9 (backport 2.37) #30809
Merged
fix: bump Go version from 1.26.5 to 1.26.9 (backport 2.36) #30810
Merged
fix: bump Go version from 1.26.5 to 1.26.9 (backport 2.34) #30811
Merged
fix: bump golang.org/x/net to v0.60.0 (backport 2.38) #30814
Merged
fix: bump golang.org/x/net to v0.60.0 (backport 2.37) #30815
Merged
fix: bump golang.org/x/net to v0.60.0 (backport 2.36) #30816
Merged
fix: bump golang.org/x/net to v0.60.0 (backport 2.35) #30817
Merged
fix: bump golang.org/x/net to v0.60.0 (backport 2.34) #30818
Merged
droopy4096 added a commit that referenced this pull request Oct 15, 2026
@droopy4096
fix: bump golang.org/x/net to v0.60.0 (backport 2.38) (#30814)
434642b 
Backport of the `golang.org/x/net` v0.60.0 bump (#30772) to
`release/2.38`, as a minimal `go.mod` / `go.sum` change.

Tracked in Linear:
[ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix)
(Iron Bank fix-by date 2026-10-29 for the Critical finding). It
complements the Go bump in
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29):
the Go bump alone does not clear GO-2026-6612 (Critical), -6603, -6610,
-6611 and -6617, which are fixed in x/net v0.60.0.

`golang.org/x/net` is v0.59.0 here; this moves it to v0.60.0. This is a
one-line change: no other module moves.

Built with go1.26.9: `go build ./enterprise/cmd/coder` succeeds. With
the Go 1.26.9 bump applied, `govulncheck -mode binary` no longer reports
GO-2026-6612, -6603, -6610, -6611, -6617, -5026 or -5942.

Opened by Superblink on behalf of @droopy4096.
droopy4096 added a commit that referenced this pull request Oct 15, 2026
@droopy4096
fix: bump Go version from 1.26.5 to 1.26.9 (#30807)
d36c153 
Bump the Go toolchain from 1.26.5 to 1.26.9 ([released
2026-10-02](https://go.dev/doc/devel/release#go1.26.9)).

Tracked in Linear:
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29).
Iron Bank fix-by date for the Critical finding is **2026-10-29**.

Go 1.26.9 includes fixes for the findings Iron Bank reported against
`coder/coder-enterprise/coder-service-2:2.38.0`. Of the 19 still-valid
advisories, 12 are only fixed in 1.26.9, including the Critical one:

- Critical: [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) /
CVE-2026-78663 (HTTP/2 server double flow-control refund)
- High: GO-2026-6603, -6605, -6607, -6608, -6609, -6610, -6611, -6613
- Low: GO-2026-6599, -6600, -6617

The other 7 (GO-2026-5026, -5942, -6088, -6089, -6090 High; -6091, -6218
Medium) are fixed since 1.26.6. The full list with links is in ENT-210.

## Changes

Same file set as #27157:

- `go.mod`: `go 1.26.5` to `go 1.26.9`
- `mise.toml` / `mise.lock`: Go toolchain pin and the archive URLs and
SHA-256 checksums for each platform (taken from the official `go.dev/dl`
release list)

## Verification

- `go build ./enterprise/cmd/coder` with go1.26.9 succeeds; `go mod tidy
-diff` is clean.
- `govulncheck -mode binary` on the resulting binary reports none of the
19 advisories above. The same scan of the released 2.38.0 binary
(go1.26.5) reports all 19.

## Not in this PR

`golang.org/x/net` v0.60.0 (the module-side half of GO-2026-6603, -6610,
-6611, -6612 and -6617) is already on `main` via #30772 and is
backported to the release branches in #30814 (2.38), #30815 (2.37),
#30816 (2.36), #30817 (2.35) and #30818 (2.34), tracked in
[ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix).
The Go 1.27.1 bump (#30288) stays a separate, larger change. Go
backports: #30808 (2.38), #30809 (2.37), #30810 (2.36), #30813 (2.35),
#30811 (2.34).

Opened by Superblink on behalf of @droopy4096.
droopy4096 added a commit that referenced this pull request Oct 15, 2026
@droopy4096
fix: bump golang.org/x/net to v0.60.0 (backport 2.34) (#30818)
24cfb82 
Backport of the `golang.org/x/net` v0.60.0 bump (#30772) to
`release/2.34`, as a minimal `go.mod` / `go.sum` change.

Tracked in Linear:
[ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix)
(Iron Bank fix-by date 2026-10-29 for the Critical finding). It
complements the Go bump in
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29):
the Go bump alone does not clear GO-2026-6612 (Critical), -6603, -6610,
-6611 and -6617, which are fixed in x/net v0.60.0.

`golang.org/x/net` is v0.55.0 here; this moves it to v0.60.0. Only
`golang.org/x/*` modules change. The extra bumps are the minimum Go's
version selection requires and cannot be held back: x/net v0.60.0
requires x/crypto v0.57.0, x/sys v0.48.0, x/term v0.46.0 and x/text
v0.42.0, and x/text v0.42.0 in turn requires x/tools v0.49.0, x/mod
v0.41.0 and x/sync v0.23.0. Also moved: golang.org/x/crypto v0.57.0,
golang.org/x/mod v0.41.0, golang.org/x/sync v0.23.0, golang.org/x/sys
v0.48.0, golang.org/x/term v0.46.0, golang.org/x/text v0.42.0,
golang.org/x/tools v0.49.0, golang.org/x/telemetry
v0.0.0-20260811182544-a038080d80e5. No non-`x` module changes.

Built with go1.26.9: `go build ./enterprise/cmd/coder` succeeds.

Opened by Superblink on behalf of @droopy4096.
droopy4096 added a commit that referenced this pull request Oct 15, 2026
@droopy4096
fix: bump golang.org/x/net to v0.60.0 (backport 2.36) (#30816)
523009b 
Backport of the `golang.org/x/net` v0.60.0 bump (#30772) to
`release/2.36`, as a minimal `go.mod` / `go.sum` change.

Tracked in Linear:
[ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix)
(Iron Bank fix-by date 2026-10-29 for the Critical finding). It
complements the Go bump in
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29):
the Go bump alone does not clear GO-2026-6612 (Critical), -6603, -6610,
-6611 and -6617, which are fixed in x/net v0.60.0.

`golang.org/x/net` is v0.57.0 here; this moves it to v0.60.0. Only
`golang.org/x/*` modules change. The extra bumps are the minimum Go's
version selection requires and cannot be held back: x/net v0.60.0
requires x/crypto v0.57.0, x/sys v0.48.0, x/term v0.46.0 and x/text
v0.42.0, and x/text v0.42.0 in turn requires x/tools v0.49.0, x/mod
v0.41.0 and x/sync v0.23.0. Also moved: golang.org/x/crypto v0.57.0,
golang.org/x/mod v0.41.0, golang.org/x/sync v0.23.0, golang.org/x/sys
v0.48.0, golang.org/x/term v0.46.0, golang.org/x/text v0.42.0,
golang.org/x/tools v0.49.0, golang.org/x/telemetry
v0.0.0-20260811182544-a038080d80e5. No non-`x` module changes.

Not built locally; CI will build it.

Opened by Superblink on behalf of @droopy4096.
droopy4096 added a commit that referenced this pull request Oct 15, 2026
@droopy4096
fix: bump golang.org/x/net to v0.60.0 (backport 2.37) (#30815)
a7437bc 
Backport of the `golang.org/x/net` v0.60.0 bump (#30772) to
`release/2.37`, as a minimal `go.mod` / `go.sum` change.

Tracked in Linear:
[ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix)
(Iron Bank fix-by date 2026-10-29 for the Critical finding). It
complements the Go bump in
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29):
the Go bump alone does not clear GO-2026-6612 (Critical), -6603, -6610,
-6611 and -6617, which are fixed in x/net v0.60.0.

`golang.org/x/net` is v0.58.0 here; this moves it to v0.60.0. Only
`golang.org/x/*` modules change. The extra bumps are the minimum Go's
version selection requires and cannot be held back: x/net v0.60.0
requires x/crypto v0.57.0, x/sys v0.48.0, x/term v0.46.0 and x/text
v0.42.0, and x/text v0.42.0 in turn requires x/tools v0.49.0, x/mod
v0.41.0 and x/sync v0.23.0. Also moved: golang.org/x/crypto v0.57.0,
golang.org/x/mod v0.41.0, golang.org/x/sync v0.23.0, golang.org/x/sys
v0.48.0, golang.org/x/term v0.46.0, golang.org/x/text v0.42.0. No
non-`x` module changes.

Not built locally; CI will build it.

Opened by Superblink on behalf of @droopy4096.
droopy4096 added a commit that referenced this pull request Oct 15, 2026
@droopy4096
fix: bump golang.org/x/net to v0.60.0 (backport 2.35) (#30817)
455a155 
Backport of the `golang.org/x/net` v0.60.0 bump (#30772) to
`release/2.35`, as a minimal `go.mod` / `go.sum` change.

Tracked in Linear:
[ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix)
(Iron Bank fix-by date 2026-10-29 for the Critical finding). It
complements the Go bump in
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29):
the Go bump alone does not clear GO-2026-6612 (Critical), -6603, -6610,
-6611 and -6617, which are fixed in x/net v0.60.0.

`golang.org/x/net` is v0.56.0 here; this moves it to v0.60.0. Only
`golang.org/x/*` modules change. The extra bumps are the minimum Go's
version selection requires and cannot be held back: x/net v0.60.0
requires x/crypto v0.57.0, x/sys v0.48.0, x/term v0.46.0 and x/text
v0.42.0, and x/text v0.42.0 in turn requires x/tools v0.49.0, x/mod
v0.41.0 and x/sync v0.23.0. Also moved: golang.org/x/crypto v0.57.0,
golang.org/x/mod v0.41.0, golang.org/x/sync v0.23.0, golang.org/x/sys
v0.48.0, golang.org/x/term v0.46.0, golang.org/x/text v0.42.0,
golang.org/x/tools v0.49.0, golang.org/x/telemetry
v0.0.0-20260811182544-a038080d80e5. No non-`x` module changes.

Not built locally; CI will build it.

Opened by Superblink on behalf of @droopy4096.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

0 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.