| 1 | # Census approval: sec-deps-dos-bumps |
| 2 | |
| 3 | Ruling `census-ruling-sec-deps-dos-bumps`. Every change below keeps the disposition it already has, so it needs an approval, not a decision. |
| 4 | |
| 5 | Envelopes re-pinned: `.`. |
| 6 | |
| 7 | Seal: `945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a` → `945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a` (unchanged; loaded after sec-host-imdsv2-module, re-chained 2026-10-24 when that merged as ef156d3). |
| 8 | |
| 9 | Overlay: `internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv`, appended to `internal/provision/testdata/plan14-root-reads-chain.tsv`. |
| 10 | |
| 11 | ## Branch context |
| 12 | |
| 13 | Branch `sec-deps-dos-bumps` bumps three modules that govulncheck reports as |
| 14 | reachable on main: |
| 15 | |
| 16 | | module | main | branch | findings | |
| 17 | |---|---|---|---| |
| 18 | | `golang.org/x/net` | v0.56.0 | v0.60.0 | GO-2026-6603, -6610, -6611, -6612, -6617 (HTTP/2 server and transport DoS) | |
| 19 | | `golang.org/x/text` | v0.38.0 | v0.42.0 | GO-2026-5970 (idna infinite loop, reached from the edge's TLS SNI handling) | |
| 20 | | `github.com/pion/stun/v3` | v3.0.1 | v3.1.5 | GO-2026-6163 (panic on a malformed XOR-MAPPED-ADDRESS, reached from the relay's TURN server) | |
| 21 | |
| 22 | x/text lands at v0.42.0, not v0.39.0, because x/net v0.60.0 requires it. The |
| 23 | same requirement moves x/crypto (v0.57.0), x/sys (v0.48.0), x/sync (v0.23.0), |
| 24 | x/mod (v0.41.0) and x/tools (v0.49.0), and raises go.mod's `go` directive from |
| 25 | `1.26` to `1.26.0`. stun v3.1.5 moves pion/dtls/v3 to v3.1.4 and |
| 26 | pion/transport/v4 to v4.0.2, and drops pion/transport/v3. pion/turn/v4 stays at |
| 27 | v4.1.4. |
| 28 | |
| 29 | The change is go.mod and go.sum only. No Go source file changes, so no read is |
| 30 | added, removed or changed, no census unit's digest moves, and the legacy seal |
| 31 | does not move. The only census effect is the envelope re-pin of `.` above. |
| 32 | The record-write census (9B8) and claim routes are unchanged. |
| 33 | |
| 34 | go.mod meets `go-1.26.10-emudhra`, which raises the same `go` directive to |
| 35 | `1.26.10` and pins `.` in its own overlay. Whichever lands second takes |
| 36 | `1.26.10` and re-pins `.` once more (rerun `make census-propose` with the same |
| 37 | NAME). |
| 38 | |
amadan