Skip to content

Fix possible fix(deps): 5 vulnerable dependencies in go.mod #698

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
begininvoke wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix possible fix(deps): 5 vulnerable dependencies in go.mod #698

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,9 +99,9 @@ require (
go.yaml.in/yaml/v2 v2.4.4 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
go4.org v0.0.0-20260112195520-a5071408f32f // indirect
golang.org/x/net v0.54.0 // indirect
golang.org/x/net v0.56.0 // indirect

@cubic-dev-ai cubic-dev-ai Bot Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: The bump edits go.mod but not go.sum, which still has checksums only for the old v0.54.0/v0.37.0 versions and none for the new v0.56.0/v0.39.0. Under the default -mod=readonly mode, go build and go mod verify will fail with missing-go.sum-entry errors. Run go mod tidy or go mod download golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0 followed by go mod tidy, then commit the regenerated go.sum.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At go.mod, line 102:

<comment>The bump edits go.mod but not go.sum, which still has checksums only for the old v0.54.0/v0.37.0 versions and none for the new v0.56.0/v0.39.0. Under the default `-mod=readonly` mode, `go build` and `go mod verify` will fail with missing-go.sum-entry errors. Run `go mod tidy` or `go mod download golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0` followed by `go mod tidy`, then commit the regenerated go.sum.</comment>

<file context>
@@ -99,9 +99,9 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
-	golang.org/x/net v0.54.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
</file context>
Fix with cubic

@cubic-dev-ai cubic-dev-ai Bot Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: These version bumps are not accompanied by the required go.sum entries, so clean builds that disallow module-file updates fail with missing checksums. Regenerate and commit go.sum for both new versions and their selected transitive modules.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At go.mod, line 102:

<comment>These version bumps are not accompanied by the required `go.sum` entries, so clean builds that disallow module-file updates fail with missing checksums. Regenerate and commit `go.sum` for both new versions and their selected transitive modules.</comment>

<file context>
@@ -99,9 +99,9 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
-	golang.org/x/net v0.54.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
</file context>
Fix with cubic

golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/text v0.37.0 // indirect
golang.org/x/text v0.39.0 // indirect
golang.org/x/time v0.15.0 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
Expand Down