Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Update golang.org/x/text to v0.39.0 — last dependency with a released security fix - #732

Merged
fabpot merged 1 commit into
symfony-cli:mainfrom
mathieu-ducrot:fix/bump-golang-x-text
Aug 8, 2026
Merged

Update golang.org/x/text to v0.39.0 — last dependency with a released security fix#732
fabpot merged 1 commit into
symfony-cli:mainfrom
mathieu-ducrot:fix/bump-golang-x-text

Conversation

@mathieu-ducrot

@mathieu-ducrot mathieu-ducrot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Context

While scanning our PHP development container images with osv-scanner (v2.4.0), we noticed the latest released binary (v5.17.1, built 2026-04-07 with Go 1.26.0) reports 56 known vulnerabilities in its embedded
dependencies — including GO-2026-5023 (CVSS 10.0) in golang.org/x/crypto v0.49.0.

Digging further, we found that main has already moved past most of these since the v5.17.1 tag (x/crypto v0.53.0, x/net v0.56.0, otel v1.44.0, go-pkcs12 v0.7.3…). The only remaining module carrying an advisory with a
released fix was golang.org/x/text v0.38.0.

This PR

Bumps golang.org/x/text v0.38.0 → v0.39.0, fixing GO-2026-5970.

  • go build . ✅
  • go test ./... ✅ (all packages pass)
  • go vet ./... ✅

Measured impact

We rebuilt the binary from this branch with Go 1.26.5 and scanned it:

v5.17.1 release binary Build from this branch (Go 1.26.5)
Advisories reported 56 (7 Critical, incl. one CVSS 10.0) 6 (0 Critical)
With a released fix 50 0

The 6 remaining advisories have no released fix anywhere: 5 are github.com/docker/docker daemon-side issues (not addressable through the Go client module) and 1 is GO-2026-5932 (x/crypto, no upstream fix yet).

Friendly ask

With this merged, main is as clean as it can currently get. Would you consider tagging a release built with Go ≥ 1.26.5? That alone would take the binary shipped to users (and embedded in countless container images, where
every security scan flags it) from 56 advisories down to 6 non-actionable ones. You have kindly done such releases before (#522, #485, #468).

Thanks for maintaining the CLI!

@mathieu-ducrot @claude
Update golang.org/x/text to v0.39.0
f36d451 
Fixes GO-2026-5970 reported by osv-scanner on the compiled binary.
With this bump, every dependency carrying a known-fixed OSV advisory
is up to date on main; a binary built from main with Go 1.26.5 now
reports only advisories that have no released fix (docker/docker
daemon-side ones and GO-2026-5932).

Co-Authored-By: Claude Opus 5 <[email protected]>
@tucksaun
tucksaun self-requested a review August 7, 2026 16:50
@tucksaun

tucksaun commented Aug 7, 2026

Copy link
Copy Markdown
Member

as far as I can tell, GO-2026-5932 is about golang.org/x/crypto/openpgp which I don't think we are using at the moment.

regarding this precise bump looks good to me 👍

@tucksaun
tucksaun requested a review from fabpot August 7, 2026 16:55
@tucksaun

tucksaun commented Aug 7, 2026

Copy link
Copy Markdown
Member

could you also check with govulncheck instead?

@mathieu-ducrot

mathieu-ducrot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

@tucksaun I tested this with govulncheck as requested.

Setup: govulncheck v1.6.0, Go vuln DB from 2026-07-27. I ran govulncheck ./...
on main and on this branch to compare.

Result:

main (x/text v0.38.0) this branch (v0.39.0)
Called vulnerabilities 21, from 2 modules 20, from 1 module

The only difference is GO-2026-5970 (infinite loop on invalid input in
golang.org/x/text, fixed in v0.39.0). It's gone on this branch, and nothing new
was introduced.

govulncheck also confirms the vulnerability was actually reachable in the code,
not just present in go.mod:

  commands/local_server_ca_install.go:76:22: commands.init calls cert.CA.MakeCert,
    which eventually calls norm.Form.Bytes
  local/php/toolbar.go:149:198: php.Server.tweakToolbar calls cases.Caser.String,
    which eventually calls norm.Form.Properties

Two unrelated things the scan surfaced (out of scope for this PR, just flagging):

  1. 17 stdlib vulnerabilities (crypto/tls, crypto/x509, archive/tar, os, net/url…),
    fixed across go1.26.1 → go1.26.5. My local toolchain was go1.26.0, so this may
    just be my machine — but since CI uses go-version-file: 'go.mod' (go 1.26.0),
    it might be worth checking which patch release setup-go actually resolves to for
    release builds. These are invisible to OSV/Dependabot since they aren't dependencies.

  2. 3 vulnerabilities in github.com/docker/[email protected]+incompatible with no
    fixed version available. They look like false positives for us: they affect the
    Moby daemon, while envs/docker.go only uses the client.

Happy to paste the full reports if useful.

@fabpot

fabpot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Thank you @mathieu-ducrot.

@fabpot
fabpot merged commit cdf1e1b into symfony-cli:main Aug 8, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fabpot fabpot fabpot approved these changes
@tucksaun tucksaun tucksaun approved these changes

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mathieu-ducrot @tucksaun @fabpot