Skip to content

fix: upgrade golang.org/x/net to v0.26.0 to fix CVE-2023-39325#333

Open
AdeshDeshmukh wants to merge 1 commit intoopenkruise:masterfrom
AdeshDeshmukh:fix-security-cve-2023-39325
Open

fix: upgrade golang.org/x/net to v0.26.0 to fix CVE-2023-39325#333
AdeshDeshmukh wants to merge 1 commit intoopenkruise:masterfrom
AdeshDeshmukh:fix-security-cve-2023-39325

Conversation

@AdeshDeshmukh
Copy link
Copy Markdown

What type of PR is this?

/kind bug
/area security

What this PR does / why we need it

Upgrades golang.org/x/net from v0.24.0 to v0.26.0 to address the HTTP/2 Rapid Reset vulnerability (CVE-2023-39325).

The vulnerability was fixed in v0.17.0, and this upgrade ensures we have the latest security patches while maintaining compatibility with Go 1.20.

Which issue(s) this PR fixes

Fixes #284

Changes made

  • golang.org/x/net: v0.24.0 → v0.26.0
  • golang.org/x/sys: v0.19.0 → v0.21.0
  • golang.org/x/term: v0.19.0 → v0.21.0
  • golang.org/x/text: v0.14.0 → v0.16.0

Testing done

  • Build tested locally (go build)
  • No code changes, only dependency versions

Does this PR introduce a user-facing change?

NONE

@kruise-bot
Copy link
Copy Markdown

@AdeshDeshmukh: The label(s) kind/bug, area/security cannot be applied, because the repository doesn't have them.

Details

In response to this:

What type of PR is this?

/kind bug
/area security

What this PR does / why we need it

Upgrades golang.org/x/net from v0.24.0 to v0.26.0 to address the HTTP/2 Rapid Reset vulnerability (CVE-2023-39325).

The vulnerability was fixed in v0.17.0, and this upgrade ensures we have the latest security patches while maintaining compatibility with Go 1.20.

Which issue(s) this PR fixes

Fixes #284

Changes made

  • golang.org/x/net: v0.24.0 → v0.26.0
  • golang.org/x/sys: v0.19.0 → v0.21.0
  • golang.org/x/term: v0.19.0 → v0.21.0
  • golang.org/x/text: v0.14.0 → v0.16.0

Testing done

  • Build tested locally (go build)
  • No code changes, only dependency versions

Does this PR introduce a user-facing change?

NONE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@kruise-bot kruise-bot requested review from FillZpp and zmberg March 24, 2026 12:36
@kruise-bot
Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign zmberg for approval by writing /assign @zmberg in a comment. For more information see:The Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kruise-bot
Copy link
Copy Markdown

Welcome @AdeshDeshmukh! It looks like this is your first PR to openkruise/rollouts 🎉

Upgraded golang.org/x/net from v0.24.0 to v0.26.0 to address
the HTTP/2 Rapid Reset vulnerability (CVE-2023-39325).

The vulnerability was fixed in v0.17.0, and this upgrade ensures
we have the latest security patches while maintaining compatibility
with Go 1.20.

Related dependencies upgraded:
- golang.org/x/sys: v0.19.0 -> v0.21.0
- golang.org/x/term: v0.19.0 -> v0.21.0
- golang.org/x/text: v0.14.0 -> v0.16.0

Fixes openkruise#284

Signed-off-by: AdeshDeshmukh <adeshkd123@gmail.com>
@AdeshDeshmukh AdeshDeshmukh force-pushed the fix-security-cve-2023-39325 branch from edd6989 to 688c909 Compare March 24, 2026 12:39
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 24, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.38%. Comparing base (8416512) to head (688c909).

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #333   +/-   ##
=======================================
  Coverage   51.38%   51.38%           
=======================================
  Files          66       66           
  Lines        8559     8559           
=======================================
  Hits         4398     4398           
  Misses       3575     3575           
  Partials      586      586           
Flag Coverage Δ
unittests 51.38% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Upgrade golang.org/x/net to v0.17.0 to fix CVE-2023-39325

2 participants