Skip to content

chore(deps): Bump to v0.55.0#3105

Merged
tbavelier merged 1 commit into
mainfrom
VULN-84184/wassim.dhif/fix-cve-2026-39821
Jun 9, 2026
Merged

chore(deps): Bump to v0.55.0#3105
tbavelier merged 1 commit into
mainfrom
VULN-84184/wassim.dhif/fix-cve-2026-39821

Conversation

@wdhif

@wdhif wdhif commented Jun 8, 2026 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Member

What does this PR do?

Bumps golang.org/x/net from v0.50.0 to v0.55.0 in both go.mod and api/go.mod to address CVE-2026-39821.

Motivation

Fixes VULN-84184.

Minimum Agent Versions

No change.

  • Agent: N/A
  • Cluster Agent: N/A

Describe your test plan

  • make managergobuild succeeds
  • go work sync + go mod tidy clean in both modules
  • CI green

Checklist

  • PR has at least one valid label: dependencies
  • PR has a milestone or the qa/skip-qa label
  • All commits are signed (see: signing commits)

@wdhif wdhif added this to the v1.28.0 milestone Jun 8, 2026
@datadog-official

This comment has been minimized.

Sign in to view
@wdhif wdhif added the dependencies Pull requests that update a dependency file label Jun 8, 2026
@wdhif
wdhif marked this pull request as ready for review June 8, 2026 16:12
@wdhif
wdhif requested review from a team and Copilot June 8, 2026 16:12
Copilot AI reviewed Jun 8, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates Go module dependencies to remediate CVE-2026-39821 by bumping golang.org/x/net to v0.55.0 across both the root module and the api submodule, along with the expected accompanying golang.org/x/* transitive version updates and checksum refreshes.

Changes:

  • Bump golang.org/x/net from v0.50.0 to v0.55.0 in go.mod and api/go.mod.
  • Refresh go.sum and api/go.sum to reflect the updated module graph (including golang.org/x/crypto, x/mod, x/sys, x/term, x/text, x/tools).

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File Description
go.mod Updates indirect golang.org/x/net to v0.55.0 and aligns related golang.org/x/* versions.
go.sum Updates checksums for the new golang.org/x/* versions pulled in by the bump.
api/go.mod Updates indirect golang.org/x/net to v0.55.0 and golang.org/x/text to v0.37.0.
api/go.sum Updates checksums for the api module’s resolved dependency graph after the bump.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@wdhif
chore(deps): Bump to v0.55.0
cab870e 
Signed-off-by: Wassim DHIF <[email protected]>
@wdhif
wdhif force-pushed the VULN-84184/wassim.dhif/fix-cve-2026-39821 branch from 8be2fd3 to cab870e Compare June 8, 2026 16:18
@codecov-commenter

codecov-commenter commented Jun 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.48%. Comparing base (df55a51) to head (cab870e).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main    #3105   +/-   ##
=======================================
  Coverage   43.48%   43.48%           
=======================================
  Files         352      352           
  Lines       30020    30020           
=======================================
  Hits        13053    13053           
  Misses      16095    16095           
  Partials      872      872
Flag Coverage Δ
unittests 43.48% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update df55a51...cab870e. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@bfrevel

bfrevel commented Jun 9, 2026

Copy link
Copy Markdown

Please also merge this PR into 1.27.

@tbavelier tbavelier modified the milestones: v1.28.0, v1.27.0 Jun 9, 2026
@tbavelier
tbavelier merged commit 76b428d into main Jun 9, 2026
43 checks passed
@tbavelier
tbavelier deleted the VULN-84184/wassim.dhif/fix-cve-2026-39821 branch June 9, 2026 07:33
This was referenced Jun 9, 2026
Merged
Merged
@tbavelier tbavelier mentioned this pull request Jun 9, 2026
Closed
3 tasks
@wdhif wdhif changed the title fix(net): Bump to v0.55.0 chore(deps): Bump to v0.55.0 Jun 9, 2026
tbavelier pushed a commit that referenced this pull request Jun 9, 2026
@dd-octo-sts @wdhif
chore(deps): Bump to v0.55.0 (#3105) (#3111)
33d6508 
(cherry picked from commit 76b428d)

Signed-off-by: Wassim DHIF <[email protected]>
Co-authored-by: Wassim Dhif <[email protected]>
tbavelier pushed a commit that referenced this pull request Jun 9, 2026
@dd-octo-sts @wdhif
chore(deps): Bump to v0.55.0 (#3105) (#3110)
f683209 
(cherry picked from commit 76b428d)

Signed-off-by: Wassim DHIF <[email protected]>
Co-authored-by: Wassim Dhif <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@zhuminyi zhuminyi zhuminyi approved these changes
@levan-m levan-m levan-m approved these changes

Assignees

No one assigned

Labels

backport/v1.27 backport/v1.28 dependencies Pull requests that update a dependency file team/container-platform

Projects

None yet

Milestone

v1.27.0

Development

Successfully merging this pull request may close these issues.

7 participants

@wdhif @codecov-commenter @bfrevel @zhuminyi @levan-m @tbavelier