#543: clear reachable vulnerabilities — go 1.26.8 + grpc v1.83.1 (v0.6.207) #560

Merged

Cordy merged 6 commits from fix-543 into main

2026-09-16 01:35:24 +00:00

Cordy commented

2026-09-16 01:33:36 +00:00

Owner

Closes #543.

go get go@patch moves the go directive from 1.26.0 to 1.26.8, clearing all 25 standard-library advisories govulncheck reported as reachable from Cairn code:

html/template escaping (GO-2026-4603 and related) — reached from the public share password form and the main server.
os FileInfo escaping a Root (GO-2026-4602) — reached from the POSIX driver's List and the audit reader.
net/url IPv6 host-literal parsing (GO-2026-4601) — reached from the preview converter and the OCM client.
Two crypto/x509 issues (GO-2026-4600, GO-2026-4599) — reached through the S3 driver's TLS handshake.

The interesting part: clearing the standard library exposed a second reachable advisory beneath it. With the stdlib traces gone, govulncheck surfaced google.golang.org/grpc@v1.83.0 in the transport layer, reachable from both peering.Client.ReceiverSpaces and the peering gRPC server in gatePeering. The guard in the one-shot refused to commit on that, which is why this PR carries two bumps rather than one — grpc moves to v1.83.1 in the same change.

Worth noting for the next time this issue fires: a vulnerability report is a stack, not a list. Fixing the top layer can reveal the next one, so "the patch bump cleared the reported CVEs" is not the same as "govulncheck is clean". The success condition has to be the scanner's own verdict.

Verification, all on the runner before the commit:

go build ./..., go vet ./... clean.
Full go test ./... green (the one-shot refuses to commit on any failure).
govulncheck ./... → "Your code is affected by 0 vulnerabilities", asserted as a hard gate.

No Cairn source changed — go.mod, go.sum and CHANGELOG.md only.

Release builds already bootstrap go1.22.5 and rely on GOTOOLCHAIN=auto to fetch the toolchain named by go.mod, so the ko build picks up 1.26.8 by the same mechanism that was already fetching 1.26.0. No workflow changes needed.

Closes #543. `go get go@patch` moves the `go` directive from **1.26.0 to 1.26.8**, clearing all 25 standard-library advisories govulncheck reported as reachable from Cairn code: - `html/template` escaping (GO-2026-4603 and related) — reached from the public share password form and the main server. - `os` FileInfo escaping a `Root` (GO-2026-4602) — reached from the POSIX driver's `List` and the audit reader. - `net/url` IPv6 host-literal parsing (GO-2026-4601) — reached from the preview converter and the OCM client. - Two `crypto/x509` issues (GO-2026-4600, GO-2026-4599) — reached through the S3 driver's TLS handshake. **The interesting part:** clearing the standard library exposed a second reachable advisory beneath it. With the stdlib traces gone, govulncheck surfaced `google.golang.org/grpc@v1.83.0` in the transport layer, reachable from both `peering.Client.ReceiverSpaces` and the peering gRPC server in `gatePeering`. The guard in the one-shot refused to commit on that, which is why this PR carries two bumps rather than one — `grpc` moves to **v1.83.1** in the same change. Worth noting for the next time this issue fires: a vulnerability report is a *stack*, not a list. Fixing the top layer can reveal the next one, so "the patch bump cleared the reported CVEs" is not the same as "govulncheck is clean". The success condition has to be the scanner's own verdict. **Verification, all on the runner before the commit:** - `go build ./...`, `go vet ./...` clean. - Full `go test ./...` green (the one-shot refuses to commit on any failure). - `govulncheck ./...` → **"Your code is affected by 0 vulnerabilities"**, asserted as a hard gate. No Cairn source changed — `go.mod`, `go.sum` and `CHANGELOG.md` only. Release builds already bootstrap go1.22.5 and rely on `GOTOOLCHAIN=auto` to fetch the toolchain named by `go.mod`, so the ko build picks up 1.26.8 by the same mechanism that was already fetching 1.26.0. No workflow changes needed.

Cordy added 6 commits

2026-09-16 01:33:37 +00:00