games-on-whales/fenrir
1
0
Fork 0
mirror of https://github.com/games-on-whales/fenrir.git synced 2026-10-15 12:51:53 +00:00
Code Issues 20 Projects Packages Wiki Activity

[PR #63] Update module golang.org/x/net to v0.55.0 [SECURITY] #63

New issue
Open
opened 2026-10-15 12:47:06 +00:00 by bsakaguchi · 0 comments
bsakaguchi commented 2026-10-15 12:47:06 +00:00
Owner
Copy link

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/fenrir/pull/63
Author: @renovate[bot]
Created: 10/13/2026
Status: 🔄 Open

Base: main ← Head: renovate/go-golang.org-x-net-vulnerability

📝 Commits (1)

  • 76022d6 Update module golang.org/x/net to v0.55.0 [SECURITY]

📊 Changes

2 files changed (+20 additions, -9 deletions)

View changed files

📝 go.mod (+9 -9)
📝 go.sum (+11 -0)

📄 Description

This PR contains the following updates:

Package Change Age Confidence
golang.org/x/net v0.34.0 → v0.55.0 age confidence

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

CVE-2025-22870 / GHSA-qxp5-gwg8-xv66

More information

Details

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Severity

  • CVSS Score: 4.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

golang.org/x/net vulnerable to Cross-site Scripting

CVE-2025-22872 / GHSA-vvgc-356p-c3xw

More information

Details

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Go Net HTML parser is vulnerable to denial of service

CVE-2026-25680 / GHSA-5cv4-jp36-h3mw

More information

Details

In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/fenrir/pull/63 **Author:** [@renovate[bot]](https://github.com/apps/renovate) **Created:** 10/13/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `renovate/go-golang.org-x-net-vulnerability` --- ### 📝 Commits (1) - [`76022d6`](https://github.com/games-on-whales/fenrir/commit/76022d6eb81a6e2728085f7bfecfee06c60ece5d) Update module golang.org/x/net to v0.55.0 [SECURITY] ### 📊 Changes **2 files changed** (+20 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `go.mod` (+9 -9) 📝 `go.sum` (+11 -0) </details> ### 📄 Description This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.34.0` → `v0.55.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.34.0...refs/tags/v0.55.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.55.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.34.0/v0.55.0?slim=true) | --- ### HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net [CVE-2025-22870](https://nvd.nist.gov/vuln/detail/CVE-2025-22870) / [GHSA-qxp5-gwg8-xv66](https://redirect.github.com/advisories/GHSA-qxp5-gwg8-xv66) <details> <summary>More information</summary> #### Details Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. #### Severity - CVSS Score: 4.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2025-22870](https://nvd.nist.gov/vuln/detail/CVE-2025-22870) - [https://go.dev/cl/654697](https://go.dev/cl/654697) - [https://go.dev/issue/71984](https://go.dev/issue/71984) - [https://pkg.go.dev/vuln/GO-2025-3503](https://pkg.go.dev/vuln/GO-2025-3503) - [http://www.openwall.com/lists/oss-security/2025/03/07/2](http://www.openwall.com/lists/oss-security/2025/03/07/2) - [https://security.netapp.com/advisory/ntap-20250509-0007](https://security.netapp.com/advisory/ntap-20250509-0007) - [https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ](https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ) - [https://github.com/advisories/GHSA-qxp5-gwg8-xv66](https://redirect.github.com/advisories/GHSA-qxp5-gwg8-xv66) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-qxp5-gwg8-xv66) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### golang.org/x/net vulnerable to Cross-site Scripting [CVE-2025-22872](https://nvd.nist.gov/vuln/detail/CVE-2025-22872) / [GHSA-vvgc-356p-c3xw](https://redirect.github.com/advisories/GHSA-vvgc-356p-c3xw) <details> <summary>More information</summary> #### Details The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts). #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2025-22872](https://nvd.nist.gov/vuln/detail/CVE-2025-22872) - [https://go.dev/cl/662715](https://go.dev/cl/662715) - [https://go.dev/issue/73070](https://go.dev/issue/73070) - [https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA](https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA) - [https://pkg.go.dev/vuln/GO-2025-3595](https://pkg.go.dev/vuln/GO-2025-3595) - [https://security.netapp.com/advisory/ntap-20250516-0007](https://security.netapp.com/advisory/ntap-20250516-0007) - [https://github.com/advisories/GHSA-vvgc-356p-c3xw](https://redirect.github.com/advisories/GHSA-vvgc-356p-c3xw) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-vvgc-356p-c3xw) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Go Net HTML parser is vulnerable to denial of service [CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) / [GHSA-5cv4-jp36-h3mw](https://redirect.github.com/advisories/GHSA-5cv4-jp36-h3mw) <details> <summary>More information</summary> #### Details In Go Net (`golang.org/x/net`) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. #### Severity - CVSS Score: 6.5 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) - [https://go.dev/cl/781702](https://go.dev/cl/781702) - [https://go.dev/issue/79573](https://go.dev/issue/79573) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://pkg.go.dev/vuln/GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028) - [https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472](https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472) - [https://go.googlesource.com/net/+/refs/tags/v0.55.0](https://go.googlesource.com/net/+/refs/tags/v0.55.0) - [https://github.com/advisories/GHSA-5cv4-jp36-h3mw](https://redirect.github.com/advisories/GHSA-5cv4-jp36-h3mw) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-5cv4-jp36-h3mw) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/games-on-whales/fenrir). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTUuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE1NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/helm-4.x
renovate/go-golang.org-x-net-vulnerability
renovate/common-5.x
renovate/mikefarah-yq-4.x
renovate/kubernetes-monorepo
renovate/alpine-3.x
renovate/helm-3.x
renovate/k8s.io-utils-digest
renovate/go-golang.org-x-image-vulnerability
renovate/pin-dependencies
feature/direwolf-dra
feature/wolf-dra-sessions
staging
chore/golang-1.26
feature/wolf-dra-driver
renovate/golang-1.x
chore/restructure-structs
chore/update-skaffold
chore/labels-and-enums
feature/better-moonlight-login
renovate/common-4.x
chore/ci-workflows
features/lobbies
feat/image-flags
fix/wolf-registry
No results found.
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
games-on-whales/fenrir#63
No description provided.