amadan
deps: bump x/net, x/text and pion/stun/v3 for reachable govulncheck findings
govulncheck on main reported seven reachable vulnerabilities: golang.org/x/net v0.56.0 (GO-2026-6603, -6610, -6611, -6612, -6617, HTTP/2 server and transport DoS, reached from the edge, tunnelclient, lbhealth, host and console), golang.org/x/text v0.38.0 (GO-2026-5970, idna infinite loop via the edge's TLS SNI) and github.com/pion/stun/v3 v3.0.1 (GO-2026-6163, panic on a malformed XOR-MAPPED-ADDRESS, reached from the relay's TURN server). - golang.org/x/net v0.56.0 -> v0.60.0 - golang.org/x/text v0.38.0 -> v0.42.0 (x/net v0.60.0 requires v0.42.0) - github.com/pion/stun/v3 v3.0.1 -> v3.1.5 Forced alongside by MVS: x/crypto v0.57.0, x/sys v0.48.0, x/sync v0.23.0, x/mod v0.41.0, x/tools v0.49.0 (x/net and x/text), pion/dtls/v3 v3.1.4 and pion/transport/v4 v4.0.2 (stun); pion/transport/v3 drops out. x/net v0.60.0 declares go 1.26.0, so go.mod's go directive moves from 1.26 to 1.26.0. pion/turn/v4 stays at v4.1.4. launchctx/go.mod requires none of these. go.mod and go.sum are in the root package's envelope, so TestPlan14RootReadCensus gets an envelope-only overlay, loaded last, re-pinning '.' and nothing else. PROPOSED-sec-deps-dos-bumps: it needs the census owner's ruling before merge (docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md). govulncheck on the branch: 0 vulnerabilities affecting the code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
5 files changed,
+91
−46
docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md+41 −0go.mod+11 −12go.sum+22 −34internal/provision/plan14_root_reads_test.go+14 −0internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv+3 −0
CI passed — run details
CI log
=== gate ===
.amadan/test-gate.sh
go: downloading golang.org/x/net v0.60.0
go: downloading golang.org/x/sys v0.48.0
go: downloading golang.org/x/crypto v0.57.0
go: downloading github.com/pion/stun/v3 v3.1.5
go: downloading golang.org/x/sync v0.23.0
go: downloading github.com/pion/transport/v4 v4.0.2
go: downloading github.com/pion/dtls/v3 v3.1.4
go: downloading golang.org/x/text v0.42.0
go: downloading golang.org/x/text v0.42.0
go: downloading github.com/pion/dtls/v3 v3.1.4
=== launchctx (1 s)
ok amadan.net/carlos/platform.git/launchctx 0.012s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
=== vet (25 s)
go: downloading golang.org/x/tools v0.49.0
go: downloading github.com/pion/dtls/v3 v3.1.4
go: downloading golang.org/x/text v0.42.0
go: downloading golang.org/x/mod v0.41.0
=== gofmt (1 s)
gofmt -l .: clean
=== rest (180 s)
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 4.072s
ok github.com/carlosframework/platform/cmd/moveprobe 11.906s
ok github.com/carlosframework/platform/cmd/zddprobe 0.798s
ok github.com/carlosframework/platform/internal/activator 60.533s
ok github.com/carlosframework/platform/internal/agentsock 0.031s
ok github.com/carlosframework/platform/internal/alerting 0.010s
ok github.com/carlosframework/platform/internal/analytics 0.031s
ok github.com/carlosframework/platform/internal/appconfig 3.410s
ok github.com/carlosframework/platform/internal/apperr 0.145s
ok github.com/carlosframework/platform/internal/applog 0.302s
ok github.com/carlosframework/platform/internal/awsinv 0.004s
ok github.com/carlosframework/platform/internal/boxchoice 0.007s
ok github.com/carlosframework/platform/internal/boxid 1.130s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.009s
ok github.com/carlosframework/platform/internal/caps 0.017s
ok github.com/carlosframework/platform/internal/certwarm 0.007s
ok github.com/carlosframework/platform/internal/cgroup 0.860s
ok github.com/carlosframework/platform/internal/changelog 0.648s
ok github.com/carlosframework/platform/internal/claimactivation 1.439s
ok github.com/carlosframework/platform/internal/clamd 0.064s
? github.com/carlosframework/platform/internal/cliflag [no test files]
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 8.185s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.012s
ok github.com/carlosframework/platform/internal/dbquery 0.009s
ok github.com/carlosframework/platform/internal/dbreads 2.103s
? github.com/carlosframework/platform/internal/dbreads/dbreadstest [no test files]
ok github.com/carlosframework/platform/internal/dbverify 0.005s
ok github.com/carlosframework/platform/internal/dnsrec 0.008s
ok github.com/carlosframework/platform/internal/docsite 0.014s
ok github.com/carlosframework/platform/internal/domains 3.313s
ok github.com/carlosframework/platform/internal/doorkey 0.015s
ok github.com/carlosframework/platform/internal/economics 0.012s
ok github.com/carlosframework/platform/internal/edge 46.015s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.008s
ok github.com/carlosframework/platform/internal/fleetapi 0.140s
ok github.com/carlosframework/platform/internal/gate 1.655s
ok github.com/carlosframework/platform/internal/genselect 0.015s
ok github.com/carlosframework/platform/internal/geo 0.019s
ok github.com/carlosframework/platform/internal/geoip 0.030s
ok github.com/carlosframework/platform/internal/historyreadback 0.155s
ok github.com/carlosframework/platform/internal/host 144.834s
ok github.com/carlosframework/platform/internal/hostactors 6.216s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.006s
ok github.com/carlosframework/platform/internal/hostbox 3.056s
ok github.com/carlosframework/platform/internal/hostclaim 0.774s
ok github.com/carlosframework/platform/internal/hostenv 0.006s
ok github.com/carlosframework/platform/internal/hostevidence 0.011s
ok github.com/carlosframework/platform/internal/hostexec 5.365s
ok github.com/carlosframework/platform/internal/hostfence 0.074s
ok github.com/carlosframework/platform/internal/hostfiles 10.360s
ok github.com/carlosframework/platform/internal/hostfloor 0.031s
ok github.com/carlosframework/platform/internal/hostguard 1.080s
ok github.com/carlosframework/platform/internal/hostops 2.003s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.002s
ok github.com/carlosframework/platform/internal/hostquarantine 0.002s
ok github.com/carlosframework/platform/internal/hostrelocate 0.697s
ok github.com/carlosframework/platform/internal/hostresolve 0.254s
ok github.com/carlosframework/platform/internal/hostwrite 0.002s
ok github.com/carlosframework/platform/internal/infraview 0.010s
ok github.com/carlosframework/platform/internal/instancectl 5.252s
ok github.com/carlosframework/platform/internal/instanceexec 2.813s
ok github.com/carlosframework/platform/internal/instancefs 0.010s
ok github.com/carlosframework/platform/internal/instancekey 0.009s
ok github.com/carlosframework/platform/internal/instanceupdates 0.022s
ok github.com/carlosframework/platform/internal/layout 1.722s
ok github.com/carlosframework/platform/internal/lbhealth 0.004s
ok github.com/carlosframework/platform/internal/lease 10.115s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.567s
ok github.com/carlosframework/platform/internal/ledger 0.024s
ok github.com/carlosframework/platform/internal/mail 0.259s
ok github.com/carlosframework/platform/internal/maintenance 0.094s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.595s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.086s
ok github.com/carlosframework/platform/internal/metrics 0.008s
ok github.com/carlosframework/platform/internal/moves 22.499s
ok github.com/carlosframework/platform/internal/moves/archive 0.993s
ok github.com/carlosframework/platform/internal/objstore 0.311s
ok github.com/carlosframework/platform/internal/ops 0.185s
ok github.com/carlosframework/platform/internal/park 0.285s
ok github.com/carlosframework/platform/internal/plans 0.013s
ok github.com/carlosframework/platform/internal/privatefile 0.006s
ok github.com/carlosframework/platform/internal/provision 31.221s
ok github.com/carlosframework/platform/internal/publicrelease 0.008s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.670s
ok github.com/carlosframework/platform/internal/relay 7.231s
ok github.com/carlosframework/platform/internal/release 25.817s
ok github.com/carlosframework/platform/internal/rollout 3.859s
ok github.com/carlosframework/platform/internal/rolloutwords 0.004s
ok github.com/carlosframework/platform/internal/rootaws 0.007s
ok github.com/carlosframework/platform/internal/rootparticipation 0.067s
ok github.com/carlosframework/platform/internal/rootstate 0.027s
ok github.com/carlosframework/platform/internal/runs 0.574s
ok github.com/carlosframework/platform/internal/s3compat 0.008s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.672s
ok github.com/carlosframework/platform/internal/seeds 0.015s
ok github.com/carlosframework/platform/internal/sim/engines 2.641s
ok github.com/carlosframework/platform/internal/sim/hostlife 11.484s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.926s
ok github.com/carlosframework/platform/internal/status 0.083s
ok github.com/carlosframework/platform/internal/steering 0.006s
ok github.com/carlosframework/platform/internal/stopevidence 0.312s
ok github.com/carlosframework/platform/internal/svcrole 0.003s
ok github.com/carlosframework/platform/internal/telemetry 0.006s
ok github.com/carlosframework/platform/internal/termfence 0.006s
ok github.com/carlosframework/platform/internal/tunnelclient 0.005s
ok github.com/carlosframework/platform/internal/unixdial 0.004s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.007s
ok github.com/carlosframework/platform/internal/version 0.003s
ok github.com/carlosframework/platform/internal/vet 1.722s
=== internal_console@0 (81 s)
ok github.com/carlosframework/platform/internal/console 79.893s
=== internal_console@1 (43 s)
ok github.com/carlosframework/platform/internal/console 41.835s
=== internal_console@2 (44 s)
ok github.com/carlosframework/platform/internal/console 42.589s
=== internal_console@3 (43 s)
ok github.com/carlosframework/platform/internal/console 41.654s
=== internal_console@4 (48 s)
ok github.com/carlosframework/platform/internal/console 46.247s
=== internal_console@5 (42 s)
ok github.com/carlosframework/platform/internal/console 40.703s
=== internal_console@6 (40 s)
ok github.com/carlosframework/platform/internal/console 38.510s
=== internal_console@7 (37 s)
ok github.com/carlosframework/platform/internal/console 35.445s
=== root@0 (108 s)
ok github.com/carlosframework/platform 106.567s
=== root@1 (91 s)
ok github.com/carlosframework/platform 89.129s
=== root@2 (82 s)
ok github.com/carlosframework/platform 80.402s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 50593954 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: downloading https://github.com/minio/minio/releases/download/RELEASE.2025-09-07T16-13-09Z/minio.linux-arm64.RELEASE.2025-09-07T16-13-09Z
minio: downloaded, digest verified
mc: downloading https://github.com/minio/mc/releases/download/RELEASE.2025-08-13T08-35-41Z/mc.linux-arm64.RELEASE.2025-08-13T08-35-41Z
mc: downloaded, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.025s
=== RUN TestT4StorageProbeMinio
2026/10/23 19:40:44 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E13FF41F68931C, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok github.com/carlosframework/platform/internal/host 0.023s
=== RUN TestS3StoreMinioContract
=== RUN TestS3StoreMinioContract/conditional_get_and_etag_listing
=== RUN TestS3StoreMinioContract/bump_through_every_mutation_path
--- PASS: TestS3StoreMinioContract (0.03s)
--- PASS: TestS3StoreMinioContract/conditional_get_and_etag_listing (0.01s)
--- PASS: TestS3StoreMinioContract/bump_through_every_mutation_path (0.02s)
PASS
ok github.com/carlosframework/platform/internal/release 0.032s
Bucket created successfully `local/dbf-deploy`.
Bucket created successfully `local/dbf-data-ie`.
Bucket created successfully `local/dbf-data-uk`.
local/dbf-deploy versioning is enabled
Created policy `dbf-console` successfully.
Created policy `dbf-ukbox` successfully.
Added user `dbfconsole` successfully.
Added user `dbfukbox` successfully.
Attached Policies: [dbf-console]
To User: dbfconsole
Attached Policies: [dbf-ukbox]
To User: dbfukbox
=== RUN TestDBForwardMinio
2026/10/23 19:40:46 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/23 19:40:46 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/23 19:40:46 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/23 19:40:46 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/23 19:40:46 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/23 19:40:46 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/23 19:40:46 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/23 19:40:46 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/23 19:40:46 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/23 19:40:46 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/23 19:40:46 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/23 19:40:46 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/23 19:40:46 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 19:40:46 console: could not notify member@example.com of a CLI token issue: keymail: lookup member@example.com: keymail: GET /api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A43599: could not determine target mailbox
agent.go:123: dbreads: dbr_s5427f5j5utip3zvvuvaucro6u: planned 3 files (1544 bytes) and restored to 3 in 10ms
agent.go:123: dbreads: dbr_s5427f5j5utip3zvvuvaucro6u: output 5 bytes in 1 confirmed chunks in 1ms
2026/10/23 19:40:47 console: db read dbr_s5427f5j5utip3zvvuvaucro6u: relayed 1 chunks (102 bytes) in 1.004s, ended done
agent.go:123: dbreads: dbr_ou44sdt2f6ekkxza5vgbab26t4: planned 1 files (720 bytes) and restored to 1 in 8ms
agent.go:123: dbreads: dbr_ou44sdt2f6ekkxza5vgbab26t4: output 5 bytes in 1 confirmed chunks in 1ms
2026/10/23 19:40:48 console: db read dbr_ou44sdt2f6ekkxza5vgbab26t4: relayed 1 chunks (102 bytes) in 1.004s, ended done
=== RUN TestDBForwardMinio/by_disconnect
=== NAME TestDBForwardMinio
agent.go:123: dbreads: dbr_tr5bbmbq6enmfu2gmt5dtls75y: planned 3 files (1544 bytes) and restored to 3 in 10ms
2026/10/23 19:40:48 console: db read dbr_tr5bbmbq6enmfu2gmt5dtls75y: relayed 0 chunks (0 bytes) in 30ms, ended client gone
agent.go:123: dbreads: dbr_tr5bbmbq6enmfu2gmt5dtls75y: output 5 bytes in 1 confirmed chunks in 35ms
=== RUN TestDBForwardMinio/by_timeout
=== NAME TestDBForwardMinio
agent.go:123: dbreads: dbr_pp2nkugbdoapwdn2qd5nm2gdnm: planned 3 files (1544 bytes) and restored to 3 in 10ms
2026/10/23 19:41:09 console: db read dbr_pp2nkugbdoapwdn2qd5nm2gdnm: relayed 0 chunks (0 bytes) in 19.875s, ended no-result
agent.go:123: dbreads: dbr_pp2nkugbdoapwdn2qd5nm2gdnm: output 5 bytes in 1 confirmed chunks in 19.846s
--- PASS: TestDBForwardMinio (22.24s)
--- PASS: TestDBForwardMinio/by_disconnect (0.17s)
--- PASS: TestDBForwardMinio/by_timeout (19.98s)
PASS
ok github.com/carlosframework/platform/internal/console 22.256s
minio contract: PASS
diff --git a/docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md b/docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md| new file mode 100644 |
| index 000000000..ef97666e3 |
| --- /dev/null |
| +++ b/docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md |
| @@ -0,0 +1,41 @@ |
| +# Census: sec-deps-dos-bumps (dependency bumps for govulncheck findings) |
| + |
| +Status: PROPOSED, `PROPOSED-sec-deps-dos-bumps`. The ruling is asked of the |
| +census owner on #280. |
| + |
| +Branch `sec-deps-dos-bumps`, cut from main at 0d9e81dc. It bumps three |
| +modules that govulncheck reports as reachable on main: |
| + |
| +| module | main | branch | findings | |
| +|---|---|---|---| |
| +| `golang.org/x/net` | v0.56.0 | v0.60.0 | GO-2026-6603, -6610, -6611, -6612, -6617 (HTTP/2 server and transport DoS) | |
| +| `golang.org/x/text` | v0.38.0 | v0.42.0 | GO-2026-5970 (idna infinite loop, reached from the edge's TLS SNI handling) | |
| +| `github.com/pion/stun/v3` | v3.0.1 | v3.1.5 | GO-2026-6163 (panic on a malformed XOR-MAPPED-ADDRESS, reached from the relay's TURN server) | |
| + |
| +x/text lands at v0.42.0, not v0.39.0, because x/net v0.60.0 requires it. |
| +The same requirement moves x/crypto (v0.57.0), x/sys (v0.48.0), x/sync |
| +(v0.23.0), x/mod (v0.41.0) and x/tools (v0.49.0), and raises go.mod's `go` |
| +directive from `1.26` to `1.26.0`. stun v3.1.5 moves pion/dtls/v3 to v3.1.4 |
| +and pion/transport/v4 to v4.0.2, and drops pion/transport/v3. pion/turn/v4 |
| +stays at v4.1.4. |
| + |
| +The change is go.mod and go.sum only. No Go source file changes, so no read |
| +is added, removed or changed, and no census unit's digest moves. |
| + |
| +Root-read census: one overlay, |
| +`internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv`, |
| +loaded last after `static-redirects`, holding one envelope re-pin: |
| + |
| +| envelope | why | |
| +|---|---| |
| +| `.` | go.mod and go.sum, from main's `75498b97…` (db-region-forward-copy) to `f5968480…` | |
| + |
| +The legacy seal does not move |
| +(`65857c29501dc7676f52921bea79d08217542ecb1d775c67d20a3460c851d831`, checked |
| +before the overlay loads and after it). |
| + |
| +Record-write census (9B8): unchanged. Claim routes: unchanged. |
| + |
| +go.mod meets `go-1.26.10-emudhra`, which raises the same `go` directive to |
| +`1.26.10` and pins `.` in its own overlay. Whichever lands second takes |
| +`1.26.10` and re-pins `.` once more. |
diff --git a/go.mod b/go.mod| index 5a0e3cad5..c320d08df 100644 |
| --- a/go.mod |
| +++ b/go.mod |
| @@ -1,6 +1,6 @@ |
| module github.com/carlosframework/platform |
| -go 1.26 |
| +go 1.26.0 |
| require ( |
| github.com/aws/aws-sdk-go-v2 v1.44.0 |
| @@ -21,12 +21,12 @@ require ( |
| github.com/aws/smithy-go v1.28.1 |
| github.com/benbjohnson/litestream v0.5.14 |
| github.com/pion/logging v0.2.4 |
| - github.com/pion/stun/v3 v3.0.1 |
| + github.com/pion/stun/v3 v3.1.5 |
| github.com/pion/turn/v4 v4.1.4 |
| github.com/superfly/ltx v0.5.1 |
| - golang.org/x/crypto v0.53.0 |
| - golang.org/x/net v0.56.0 |
| - golang.org/x/sys v0.46.0 |
| + golang.org/x/crypto v0.57.0 |
| + golang.org/x/net v0.60.0 |
| + golang.org/x/sys v0.48.0 |
| modernc.org/sqlite v1.55.0 |
| ) |
| @@ -60,10 +60,9 @@ require ( |
| github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect |
| github.com/ncruces/go-strftime v1.0.0 // indirect |
| github.com/pierrec/lz4/v4 v4.1.22 // indirect |
| - github.com/pion/dtls/v3 v3.0.7 // indirect |
| + github.com/pion/dtls/v3 v3.1.4 // indirect |
| github.com/pion/randutil v0.1.0 // indirect |
| - github.com/pion/transport/v3 v3.0.8 // indirect |
| - github.com/pion/transport/v4 v4.0.1 // indirect |
| + github.com/pion/transport/v4 v4.0.2 // indirect |
| github.com/prometheus/client_golang v1.17.0 // indirect |
| github.com/prometheus/client_model v0.5.0 // indirect |
| github.com/prometheus/common v0.45.0 // indirect |
| @@ -73,8 +72,9 @@ require ( |
| github.com/tetratelabs/wazero v1.2.1 // indirect |
| github.com/wasilibs/go-re2 v1.3.0 // indirect |
| github.com/wlynxg/anet v0.0.5 // indirect |
| - golang.org/x/sync v0.21.0 // indirect |
| - golang.org/x/text v0.38.0 // indirect |
| + golang.org/x/mod v0.41.0 // indirect |
| + golang.org/x/sync v0.23.0 // indirect |
| + golang.org/x/text v0.42.0 // indirect |
| google.golang.org/protobuf v1.36.10 // indirect |
| modernc.org/libc v1.74.1 // indirect |
| modernc.org/mathutil v1.7.1 // indirect |
| @@ -86,8 +86,7 @@ require ( |
| github.com/aws/aws-sdk-go-v2/service/sns v1.43.0 |
| github.com/klauspost/compress v1.18.0 |
| github.com/oschwald/maxminddb-golang v1.13.1 |
| - golang.org/x/mod v0.37.0 |
| - golang.org/x/tools v0.47.0 |
| + golang.org/x/tools v0.49.0 |
| ) |
| replace amadan.net/carlos/platform.git/launchctx => ./launchctx |
diff --git a/go.sum b/go.sum| index 4558d7955..a7dd6e987 100644 |
| --- a/go.sum |
| +++ b/go.sum |
| @@ -154,18 +154,16 @@ github.com/oschwald/maxminddb-golang v1.13.1 h1:G3wwjdN9JmIK2o/ermkHM+98oX5fS+k5 |
| github.com/oschwald/maxminddb-golang v1.13.1/go.mod h1:K4pgV9N/GcK694KSTmVSDTODk4IsCNThNdTmnaBZ/F8= |
| github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU= |
| github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4= |
| -github.com/pion/dtls/v3 v3.0.7 h1:bItXtTYYhZwkPFk4t1n3Kkf5TDrfj6+4wG+CZR8uI9Q= |
| -github.com/pion/dtls/v3 v3.0.7/go.mod h1:uDlH5VPrgOQIw59irKYkMudSFprY9IEFCqz/eTz16f8= |
| +github.com/pion/dtls/v3 v3.1.4 h1:QhvtMflMfu9Kf0RcDC5BJBle4caPskByrKQR6uuYqpY= |
| +github.com/pion/dtls/v3 v3.1.4/go.mod h1:cr/qotLISUw/9C1m83ZPNZtj9WnXkYLpfCptPqbkInc= |
| github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8= |
| github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so= |
| github.com/pion/randutil v0.1.0 h1:CFG1UdESneORglEsnimhUjf33Rwjubwj6xfiOXBa3mA= |
| github.com/pion/randutil v0.1.0/go.mod h1:XcJrSMMbbMRhASFVOlj/5hQial/Y8oH/HVo7TBZq+j8= |
| -github.com/pion/stun/v3 v3.0.1 h1:jx1uUq6BdPihF0yF33Jj2mh+C9p0atY94IkdnW174kA= |
| -github.com/pion/stun/v3 v3.0.1/go.mod h1:RHnvlKFg+qHgoKIqtQWMOJF52wsImCAf/Jh5GjX+4Tw= |
| -github.com/pion/transport/v3 v3.0.8 h1:oI3myyYnTKUSTthu/NZZ8eu2I5sHbxbUNNFW62olaYc= |
| -github.com/pion/transport/v3 v3.0.8/go.mod h1:+c2eewC5WJQHiAA46fkMMzoYZSuGzA/7E2FPrOYHctQ= |
| -github.com/pion/transport/v4 v4.0.1 h1:sdROELU6BZ63Ab7FrOLn13M6YdJLY20wldXW2Cu2k8o= |
| -github.com/pion/transport/v4 v4.0.1/go.mod h1:nEuEA4AD5lPdcIegQDpVLgNoDGreqM/YqmEx3ovP4jM= |
| +github.com/pion/stun/v3 v3.1.5 h1:Y1FHlhaI6+4UoC5i/zQf4F7JvdZtB24/05oyy/GF1x8= |
| +github.com/pion/stun/v3 v3.1.5/go.mod h1:zRUghXSQU32Lx5orJsz3uYMkIihweXb3mu5gIns02fs= |
| +github.com/pion/transport/v4 v4.0.2 h1:ifYlPqNwsy6aKQ9y8yzxXlHae5431ZrH2avkD/Rn6Tk= |
| +github.com/pion/transport/v4 v4.0.2/go.mod h1:06hFI+jCFcok2X2MekVufNZ/uzNZXivGBPfviSVcjgM= |
| github.com/pion/turn/v4 v4.1.4 h1:EU11yMXKIsK43FhcUnjLlrhE4nboHZq+TXBIi3QpcxQ= |
| github.com/pion/turn/v4 v4.1.4/go.mod h1:ES1DXVFKnOhuDkqn9hn5VJlSWmZPaRJLyBXoOeO/BmQ= |
| github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ= |
| @@ -214,35 +212,25 @@ go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF |
| go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs= |
| go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI= |
| go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA= |
| -golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= |
| -golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= |
| -golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= |
| -golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= |
| -golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= |
| -golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= |
| -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= |
| -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= |
| -golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= |
| -golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= |
| -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= |
| -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= |
| +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= |
| +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= |
| +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= |
| +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= |
| +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= |
| +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= |
| golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= |
| golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= |
| -golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= |
| -golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= |
| +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= |
| +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= |
| golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= |
| -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= |
| -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= |
| -golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= |
| -golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= |
| -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= |
| -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= |
| -golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4= |
| -golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= |
| -golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c= |
| -golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI= |
| -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= |
| -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= |
| +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= |
| +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= |
| +golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= |
| +golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= |
| +golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= |
| +golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= |
| +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= |
| +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= |
| golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= |
| google.golang.org/api v0.155.0 h1:vBmGhCYs0djJttDNynWo44zosHlPvHmA0XiN2zP2DtA= |
| google.golang.org/api v0.155.0/go.mod h1:GI5qK5f40kCpHfPn6+YzGAByIKWv8ujFnmoWm7Igduk= |
diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go| index a38913fe7..fe819b486 100644 |
| --- a/internal/provision/plan14_root_reads_test.go |
| +++ b/internal/provision/plan14_root_reads_test.go |
| @@ -1423,6 +1423,20 @@ func TestPlan14RootReadCensus(t *testing.T) { |
| t.Fatal(err) |
| } |
| seal = "65857c29501dc7676f52921bea79d08217542ecb1d775c67d20a3460c851d831" |
| + // Census overlay sec-deps-dos-bumps (golang.org/x/net v0.60.0, |
| + // golang.org/x/text v0.42.0 and github.com/pion/stun/v3 v3.1.5 for |
| + // govulncheck's reachable DoS findings), loaded last, after |
| + // static-redirects. Envelope-only: go.mod and go.sum re-pin the root |
| + // package's envelope and nothing else; no read is added, removed or |
| + // changed, so the seal does not move. PROPOSED-sec-deps-dos-bumps, asked |
| + // of the census owner on #280 |
| + // (docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md). |
| + if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 { |
| + t.Fatal(errs) |
| + } |
| + if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv"), &inv, true); err != nil { |
| + t.Fatal(err) |
| + } |
| errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...) |
| errs = append(errs, checkRootReadDeclarations(got, inv)...) |
| if len(errs) > 0 { |
diff --git a/internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv b/internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv| new file mode 100644 |
| index 000000000..3e5c9eec7 |
| --- /dev/null |
| +++ b/internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv |
| @@ -0,0 +1,3 @@ |
| +# Census overlay sec-deps-dos-bumps (go.mod and go.sum move golang.org/x/net to v0.60.0, golang.org/x/text to v0.42.0 and github.com/pion/stun/v3 to v3.1.5 for govulncheck's HTTP/2 DoS, idna infinite-loop and STUN panic findings; x/net v0.60.0 also raises the go directive from 1.26 to 1.26.0 and pulls x/crypto, x/sys, x/sync, x/mod, x/tools, pion/dtls and pion/transport/v4 forward), loaded LAST in TestPlan14RootReadCensus, after static-redirects. PROPOSED: rev3=PROPOSED-sec-deps-dos-bumps, ruling asked of the census owner on #280 (docs/superpowers/notes/census-proposal-sec-deps-dos-bumps.md). |
| +# Envelope-only. go.mod and go.sum are in the root package's source envelope, so the bump re-pins `.` from main's 75498b97… (db-region-forward-copy) to the value below. No source file changes: no root-read unit is added, changed or removed, and the legacy seal does not move. |
| +@coverage . f596848000095afa31c7dcc6517ce22b56e333cc2eb828fe07c30996eac8f1ee |