From bf9ba13747f44483507738cdc82dfa3cc17f1a2e Mon Sep 17 00:00:00 2001 From: Nils Lehnen <30603423+iderex@users.noreply.github.com> Date: Mon, 7 Sep 2026 05:19:34 +0200 Subject: [PATCH] Move golang.org/x/sys to v0.44.0, so the dependency set carries no open advisory golang.org/x/sys v0.34.0 sits in go.sum as an indirect requirement of chromedp, and GO-2026-5024 (CVE-2026-39824) is filed against every release of that module before v0.44.0. The supply-chain analysis reads the requirement set and raised the Vulnerabilities class on it, and a catalogue whose own dependency set carries a known advisory is the wrong posture for a tree that exists to tell servers what to trust. The affected symbol is NewNTUnicodeString under golang.org/x/sys/windows, which nothing in this tree calls; the requirement arrives through chromedp for the keyboard measurement. The bump therefore changes no behaviour here and removes the advisory from the set the analysis reads. The go directive moves from `go 1.25` to `go 1.25.0` in the same change, because `go mod tidy` under the current toolchain rewrites it to the three-part form and refuses to leave the two-part one; restoring the short form and running tidy again reproduces the rewrite. For #175. Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index cef9e21..93f85eb 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module flowfin.dev/hub -go 1.25 +go 1.25.0 require github.com/chromedp/chromedp v0.14.2 @@ -11,5 +11,5 @@ require ( github.com/gobwas/httphead v0.1.0 // indirect github.com/gobwas/pool v0.2.1 // indirect github.com/gobwas/ws v1.4.0 // indirect - golang.org/x/sys v0.34.0 // indirect + golang.org/x/sys v0.44.0 // indirect ) diff --git a/go.sum b/go.sum index a62ad28..cf810c4 100644 --- a/go.sum +++ b/go.sum @@ -17,5 +17,5 @@ github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde h1:x0TT0RDC7UhAVbbWWBzr41ElhJx5tXPWkIHA2HWPRuw= github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA= -golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ= +golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=