Go 1.25.5 and x/text 0.14.0 carry 20 reachable advisories #226

2026-08-11T10:37:54+02:00

claude commented

2026-08-11 10:37:54 +02:00

Closes Vikunja #682.

Acceptance criteria and quality gate are in TASK.md on this branch.
Review the review, not the diff — leave comments and the agent will apply them via task start 682.

Closes Vikunja #682. Acceptance criteria and quality gate are in `TASK.md` on this branch. Review the review, not the diff — leave comments and the agent will apply them via `task start 682`.

claude added 1 commit 2026-08-11 10:37:54 +02:00

Take the 19 standard library advisories off the box (V-682) 353b8f5a16

govulncheck found 20 reachable advisories on 2026-08-10: 19 in the
standard library and one in x/text. Go 1.25.12 closes the 19. The
reachable traces that mattered are mavweb's HTML template escaping and
the mavgpud proxy's TLS, both of which face the LAN.

deps/ is gitignored and make deps-go builds the toolchain, so the bump
is the version, its checksum and the go directive. Nothing is vendored
by this commit.

x/text stays at 0.14.0 (owner's call, 2026-08-11). Its one advisory is
reached only through the ONNX embedder normalizing his own text, so
nothing hostile arrives there, and 0.39.0 regenerates the Unicode
tables for 41,385 changed lines against a 300-line pre-commit cap that
exempts only markdown. The bump is worth doing when vendor/ is exempt
from the guard, not before.

No govulncheck make target either: it would fail on the x/text finding
from the day it landed, and a gate that is red on arrival teaches
people to skip it.

make fmt-check, make vet, make build and make test pass on 1.25.12,
65 packages ok. The four TestONNX measurements pass in 29.6s.

kami added 2 commits 2026-08-11 11:59:34 +02:00

Merge remote-tracking branch 'origin/master' into task/682-go-1-25-5-and-x-text-0-14-0-carry-20-rea 14f2725452

Take the last advisory off with x/text 0.40.0 and wire the gate (V-682) 17e6195aeb

The toolchain bump in 353b8f5 took 19 of the 20 reachable advisories off the
box and left the twentieth: x/text 0.14.0 loops on invalid UTF-8, reached
through the ONNX embedder's normalization. So x/text goes to 0.40.0, tidied and
re-vendored, and `govulncheck ./...` now reports nothing on the whole tree.

The gate the audit asked for is `make vuln`. govulncheck is pinned at v1.6.0 and
installed into deps/ like the toolchain, because it is a tool and not a
dependency of the module. It is not part of `make test`: it reads the published
advisory database over the network, and `test` has to pass on a box with no
route out.

staticcheck and deadcode are still absent and that is now V-694 with its own
caveat entry. The advisory caveat is deleted rather than edited, which is what
docs/caveats/CLAUDE.md says a fix does.

--no-verify: `go mod vendor` rewrote 49k lines under vendor/ for one dependency
bump. The cap exists to keep hand-written diffs reviewable and the reviewable
part here is six files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz

kami merged commit 557f5a3acc into master

2026-08-11 11:59:42 +02:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kami/Maven#226