[thaJeztah]

full diff: golang/net@v0.61.0...v0.62.0

This release addresss the following security issues:

• html: avoid quadratic complexity when coalescing text nodes

  When coalescing adjacent text nodes in addText and fosterParent,
  appending to an existing TextNode's Data via string concatenation
  (n.Data += text) reallocated and copied the accumulated string on every
  token. Inputs containing many short text runs separated by ignored end
  tags (such as "a") caused O(n^2) allocations and byte copies.

  Accumulate coalesced text in per-node byte slices during parsing and
  materialize Data strings once at the end of parse.

  Thanks to Markus Magnuson for reporting this issue.

  This is CVE-2026-78661 and Go issue https://go.dev/issue/82224.

• html: check all ancestor namespace transitions when rendering raw text

  In childTextNodesAreLiteral, walking up the tree previously stopped at
  the nearest foreign ancestor once an HTML integration point was found.
  However, that integration point may itself be a descendant of an element
  that was foster-parented into a foreign namespace (such as or
  fostered under ), causing a parser to resolve the
  subtree in a different foreign namespace upon re-parsing the rendered
  output.

  Continue walking the full ancestor chain and verify that every
  transition from a non-empty namespace occurs at an HTML integration
  point before emitting literal text.

  Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue.

  This is CVE-2026-97045 and Go issue https://go.dev/issue/82622.

Summary

Release notes (optional)

A picture of a cute animal (not mandatory but encouraged)

[docker-agent]

Assessment: 🟢 APPROVE

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[docker-agent]

Assessment: 🔴 CRITICAL

The PR updates metadata files to declare golang.org/x/net v0.62.0 but the vendored source files under vendor/golang.org/x/net/ were not updated. The git log shows these sources are still at v0.60.0. Running go mod vendor is needed to regenerate the vendor directory with the correct sources.

[docker-agent]

[high] Vendored source files for golang.org/x/net not updated — binary will use v0.60.0 sources despite metadata claiming v0.62.0

The PR updates three metadata files (vendor.mod, vendor.sum, vendor/modules.txt) to declare golang.org/x/net v0.62.0, but the actual Go source files under vendor/golang.org/x/net/ were not updated. git log confirms the vendored sources were last updated in the commit for v0.60.0, not v0.61.0 or v0.62.0:

git log --oneline -3 vendor/golang.org/x/net/http2/transport.go
949bf401dd vendor: golang.org/x/net v0.60.0
60dffc9412 vendor: golang.org/x/net v0.59.0
cf53a284da vendor: golang.org/x/net v0.58.0

The PR commit stat confirms only 3 metadata files changed — no source files under vendor/golang.org/x/net/ were touched.

Impact: When building with -mod=vendor (the default in Go when a vendor/ directory is present), the Go toolchain compiles directly from the vendored source files and ignores the module cache. Any changes made to http2, httpguts, idna, or other vendored packages between v0.60.0 and v0.62.0 will be absent from the compiled binary. The CVEs mentioned (CVE-2026-78661, CVE-2026-97045) are in the html package which is not vendored, so those specific fixes are irrelevant here — but other bug fixes and changes in the vendored packages between v0.60.0 and v0.62.0 will be silently missing.

Fix: Run go mod vendor (or equivalent) to regenerate the vendor/ directory with the v0.62.0 sources. The resulting diff should include changes to source files under vendor/golang.org/x/net/.

Confidence	Score
🟢 strong	97/100

[thaJeztah]

None of the changes in this version are used in this repository, so it's expected that they don't show up in vendor.

[docker-agent]

You're absolutely right, thank you for the clarification! I can see that v0.61.0 also only updated the metadata files (3 files changed), while v0.60.0 was the last version that actually changed vendored source files. This means the changes between v0.60.0 and v0.62.0 genuinely didn't affect any of the packages docker/cli vendors from golang.org/x/net (http2, httpguts, idna, trace, etc.).

I incorrectly assumed that every version bump must include source changes. In reality, when a module releases a new version but only modifies packages that aren't used by this project, vendoring only the metadata is correct behavior. My apologies for the noise!