Repository navigation
chore(deps): Go 1.26, pgx 5.9.2, x/crypto 0.52.0, x/text 0.43.0 - #11
Merged
Merged
Conversation
Clears the Dependabot alerts on the Control Plane's runtime dependencies
(pgx: memory safety and SQL injection; x/crypto: ssh, which SeedGrid does not
use, but the module is updated anyway) and two x/text vulnerabilities that
govulncheck found reachable from our code. x/crypto 0.52 needs Go >= 1.25, so
the project moves from 1.23 (out of support) to 1.26 in go.mod, go.work, CI,
the Dockerfile and the build scripts.
Go 1.24+ names embedded structs in json.UnmarshalTypeError.Field
("Profile.taxonomy.id"); the profile import now strips them so the error still
points at the document's own path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #1.
Why
x/crypto/ssh. SeedGrid only usesbcrypt, so none is reachable, but the module is updated anyway.govulncheckfound two vulnerabilities in it reachable from our code (GO-2026-6629, GO-2026-5970); Dependabot had not flagged them.go.mod(3 modules),go.work, CI (setup-go), the Control PlaneDockerfile,build-*.sh,test-control-plane.shand the Deployment doc (both languages).One behaviour change from Go
Since Go 1.24,
json.UnmarshalTypeError.Fieldnames embedded structs: a wrong type in a profile file reportedProfile.taxonomy.idinstead oftaxonomy.id.decodeErrornow drops the leading Go type names (jsonPath), so the error still points at the document's own path — caught byTestParseDocument_FieldPathInError.Checked (throwaway copy, Go 1.26.9): Control Plane, Agent and tools — gofmt, vet, build, golangci-lint
latest, tests (with the database), architecture and language policies; scripts job; static builds of the Agent (amd64 + arm64) and the controller;govulncheck→ 0 vulnerabilities in the three modules.🤖 Generated with Claude Code
https://claude.ai/code/session_011zryDU4fyoYBdBCFGqkQXa