Repository navigation
vendor: golang.org/x/net v0.62.0 - #7465
Conversation
full diff: golang/net@v0.61.0...v0.62.0 This release addresss the following security issues: - html: avoid quadratic complexity when coalescing text nodes When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse. Thanks to Markus Magnuson for reporting this issue. This is CVE-2026-78661 and Go issue https://go.dev/issue/82224. - html: check all ancestor namespace transitions when rendering raw text In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue. This is CVE-2026-97045 and Go issue https://go.dev/issue/82622. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🔴 CRITICAL
The PR updates metadata files to declare golang.org/x/net v0.62.0 but the vendored source files under vendor/golang.org/x/net/ were not updated. The git log shows these sources are still at v0.60.0. Running go mod vendor is needed to regenerate the vendor directory with the correct sources.
| golang.org/x/mod/module | ||
| golang.org/x/mod/semver | ||
| # golang.org/x/net v0.61.0 | ||
| # golang.org/x/net v0.62.0 |
There was a problem hiding this comment.
[high] Vendored source files for golang.org/x/net not updated — binary will use v0.60.0 sources despite metadata claiming v0.62.0
The PR updates three metadata files (vendor.mod, vendor.sum, vendor/modules.txt) to declare golang.org/x/net v0.62.0, but the actual Go source files under vendor/golang.org/x/net/ were not updated. git log confirms the vendored sources were last updated in the commit for v0.60.0, not v0.61.0 or v0.62.0:
git log --oneline -3 vendor/golang.org/x/net/http2/transport.go
949bf401dd vendor: golang.org/x/net v0.60.0
60dffc9412 vendor: golang.org/x/net v0.59.0
cf53a284da vendor: golang.org/x/net v0.58.0
The PR commit stat confirms only 3 metadata files changed — no source files under vendor/golang.org/x/net/ were touched.
Impact: When building with -mod=vendor (the default in Go when a vendor/ directory is present), the Go toolchain compiles directly from the vendored source files and ignores the module cache. Any changes made to http2, httpguts, idna, or other vendored packages between v0.60.0 and v0.62.0 will be absent from the compiled binary. The CVEs mentioned (CVE-2026-78661, CVE-2026-97045) are in the html package which is not vendored, so those specific fixes are irrelevant here — but other bug fixes and changes in the vendored packages between v0.60.0 and v0.62.0 will be silently missing.
Fix: Run go mod vendor (or equivalent) to regenerate the vendor/ directory with the v0.62.0 sources. The resulting diff should include changes to source files under vendor/golang.org/x/net/.
| Confidence | Score |
|---|---|
| 🟢 strong | 97/100 |
There was a problem hiding this comment.
None of the changes in this version are used in this repository, so it's expected that they don't show up in vendor.
There was a problem hiding this comment.
You're absolutely right, thank you for the clarification! I can see that v0.61.0 also only updated the metadata files (3 files changed), while v0.60.0 was the last version that actually changed vendored source files. This means the changes between v0.60.0 and v0.62.0 genuinely didn't affect any of the packages docker/cli vendors from golang.org/x/net (http2, httpguts, idna, trace, etc.).
I incorrectly assumed that every version bump must include source changes. In reality, when a module releases a new version but only modifies packages that aren't used by this project, vendoring only the metadata is correct behavior. My apologies for the noise!
full diff: golang/net@v0.61.0...v0.62.0
This release addresss the following security issues:
html: avoid quadratic complexity when coalescing text nodes
When coalescing adjacent text nodes in addText and fosterParent,
appending to an existing TextNode's Data via string concatenation
(n.Data += text) reallocated and copied the accumulated string on every
token. Inputs containing many short text runs separated by ignored end
tags (such as "a") caused O(n^2) allocations and byte copies.
Accumulate coalesced text in per-node byte slices during parsing and
materialize Data strings once at the end of parse.
Thanks to Markus Magnuson for reporting this issue.
This is CVE-2026-78661 and Go issue https://go.dev/issue/82224.
html: check all ancestor namespace transitions when rendering raw text
In childTextNodesAreLiteral, walking up the tree previously stopped at
the nearest foreign ancestor once an HTML integration point was found.
However, that integration point may itself be a descendant of an element
that was foster-parented into a foreign namespace (such as or
fostered under ), causing a parser to resolve the
subtree in a different foreign namespace upon re-parsing the rendered
output.
Continue walking the full ancestor chain and verify that every
transition from a non-empty namespace occurs at an HTML integration
point before emitting literal text.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue.
This is CVE-2026-97045 and Go issue https://go.dev/issue/82622.
Summary
Release notes (optional)
A picture of a cute animal (not mandatory but encouraged)