chore(deps): update module golang.org/x/net to v0.38.0 [security] #1028

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

renovate-bot wants to merge 1 commit into GoogleCloudPlatform:main from renovate-bot:renovate/go-golang.org-x-net-vulnerability

Contributor

renovate-bot commented Mar 13, 2025 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
golang.org/x/net	`v0.34.0` -> `v0.38.0`
golang.org/x/net	`v0.35.0` -> `v0.38.0`

GitHub Vulnerability Alerts

CVE-2025-22870

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

CVE-2025-22872

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

forking-renovate bot added the dependencies label

renovate-bot requested a review from a team as a code owner

March 13, 2025 01:52

forking-renovate bot added the Skip Changelog label

forking-renovate bot commented Mar 13, 2025 •

edited

Loading

ℹ Artifact update notice

File name: e2e-test-server/cloud_functions/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.32.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.10.0` -> `v0.12.0`
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: e2e-test-server/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.32.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.10.0` -> `v0.12.0`
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: example/metric/collector/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: example/metric/exponential_histogram/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.32.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.10.0` -> `v0.12.0`
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: example/metric/otlpgrpc/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: example/metric/sdk/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.32.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.10.0` -> `v0.12.0`
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: example/trace/http/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.32.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.10.0` -> `v0.12.0`
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: example/trace/otlpgrpc/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: example/trace/otlphttp/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: exporter/collector/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.33.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.11.0` -> `v0.12.0`
`golang.org/x/sys`	`v0.30.0` -> `v0.31.0`
`golang.org/x/text`	`v0.22.0` -> `v0.23.0`

File name: exporter/collector/googlemanagedprometheus/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: exporter/collector/integrationtest/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.33.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.11.0` -> `v0.12.0`
`golang.org/x/sys`	`v0.30.0` -> `v0.31.0`
`golang.org/x/text`	`v0.22.0` -> `v0.23.0`

File name: exporter/metric/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/crypto`	`v0.32.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.10.0` -> `v0.12.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: exporter/trace/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.32.0` -> `v0.36.0`
`golang.org/x/sync`	`v0.10.0` -> `v0.12.0`
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: extension/googleclientauthextension/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

3 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.32.0` -> `v0.36.0`
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

File name: internal/cloudmock/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`golang.org/x/sys`	`v0.29.0` -> `v0.31.0`
`golang.org/x/text`	`v0.21.0` -> `v0.23.0`

renovate-bot force-pushed the renovate/go-golang.org-x-net-vulnerability branch from b010149 to 3c18542 Compare

March 13, 2025 04:37

renovate-bot changed the title ~~chore(deps): update module golang.org/x/net to v0.36.0 [security]~~ chore(deps): update module golang.org/x/net [security]

renovate-bot force-pushed the renovate/go-golang.org-x-net-vulnerability branch from 3c18542 to 702271d Compare

April 16, 2025 23:09

renovate-bot changed the title ~~chore(deps): update module golang.org/x/net [security]~~ chore(deps): update module golang.org/x/net to v0.38.0 [security]

renovate-bot force-pushed the renovate/go-golang.org-x-net-vulnerability branch from 702271d to eb9311d Compare

April 16, 2025 23:14


          chore(deps): update module golang.org/x/net to v0.38.0 [security]

7b0bfb9

renovate-bot force-pushed the renovate/go-golang.org-x-net-vulnerability branch from eb9311d to 7b0bfb9 Compare

April 29, 2025 16:15

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Skip Changelog