GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: bump golang.org/x/net to v0.60.0 (backport 2.38) by droopy4096 · Pull Request #30814 · coder/coder

Conversation

@droopy4096

@droopy4096 droopy4096 commented Oct 14, 2026

Copy link
Copy Markdown
Contributor

Backport of the golang.org/x/net v0.60.0 bump (#30772) to release/2.38, as a minimal go.mod / go.sum change.

Tracked in Linear: ENT-211 (Iron Bank fix-by date 2026-10-29 for the Critical finding). It complements the Go bump in ENT-210: the Go bump alone does not clear GO-2026-6612 (Critical), -6603, -6610, -6611 and -6617, which are fixed in x/net v0.60.0.

golang.org/x/net is v0.59.0 here; this moves it to v0.60.0. This is a one-line change: no other module moves.

Built with go1.26.9: go build ./enterprise/cmd/coder succeeds. With the Go 1.26.9 bump applied, govulncheck -mode binary no longer reports GO-2026-6612, -6603, -6610, -6611, -6617, -5026 or -5942.

Opened by Superblink on behalf of @droopy4096.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@droopy4096
fix: bump golang.org/x/net to v0.60.0 (backport 2.38)
fdde032
@droopy4096 droopy4096 added community Pull Requests and issues created by the community. cherry-pick/v2.38 Cherry-pick PR targeting release/2.38 labels Oct 14, 2026
@github-actions

github-actions Bot commented Oct 14, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@github-actions github-actions Bot assigned droopy4096 Oct 14, 2026
@linear-code

linear-code Bot commented Oct 14, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

ENT-211

ENT-215
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
This was referenced Oct 14, 2026
fix: bump Go version from 1.26.5 to 1.26.9 (backport 2.38) #30808
Merged
fix: bump Go version from 1.26.5 to 1.26.9 #30807
Merged
denisra
denisra approved these changes Oct 15, 2026
View reviewed changes
@coder
coder Bot requested a review from denisra October 15, 2026 15:49
denisra
denisra approved these changes Oct 15, 2026
View reviewed changes
droopy4096 added a commit that referenced this pull request Oct 15, 2026
@droopy4096
fix: bump Go version from 1.26.5 to 1.26.9 (backport 2.38) (#30808)
f2dba87 
Backport of #30807 to `release/2.38`.

Bumps the Go toolchain from 1.26.5 to 1.26.9. Tracked in Linear:
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29)
(Iron Bank fix-by date 2026-10-29 for the Critical finding). Same
approach as the Terraform 1.16.5 backports (#30516 and its backports).

Files changed: `go.mod`, `mise.toml`, `mise.lock` (toolchain pin plus
the per-platform archive URLs and SHA-256 checksums from the official
`go.dev/dl` list).

Verified: `go build ./enterprise/cmd/coder` with go1.26.9 succeeds.
`govulncheck -mode binary` on the result no longer reports GO-2026-5026,
-5942, -6088, -6089, -6090, -6091, -6218, -6599, -6600, -6605, -6607,
-6608, -6609 or -6613.

**Companion PR:** the module side of GO-2026-6612 (Critical), -6603,
-6610, -6611 and -6617 is fixed by `golang.org/x/net` v0.60.0,
backported in #30814
([ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix)).
This PR alone does not clear them; both are needed.

Opened by Superblink on behalf of @droopy4096.
@droopy4096
droopy4096 merged commit 434642b into release/2.38 Oct 15, 2026
62 of 65 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@droopy4096
droopy4096 deleted the backport/xnet-0.60.0-release-2.38 branch October 15, 2026 18:53
@github-actions github-actions Bot locked and limited conversation to collaborators Oct 15, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@denisra denisra denisra approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@droopy4096 droopy4096

Labels

cherry-pick/v2.38 Cherry-pick PR targeting release/2.38 community Pull Requests and issues created by the community.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@droopy4096 @denisra
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.