chore(deps): Go module updates — x/text advisory GO-2026-5970, sqlite v1.55.0 + libc lockstep, client_golang v1.24.1, yaml v2.4.4 #253

Open

dominik.polakovics wants to merge 1 commit from afk/250 into main

dominik.polakovics commented

2026-07-31 05:12:41 +02:00

Owner

Closes #250

What moved

Module	Before	After
`golang.org/x/text` (indirect)	v0.38.0	v0.40.0 — closes GO-2026-5970
`modernc.org/sqlite`	v1.53.0	v1.55.0
`modernc.org/libc` (indirect)	v1.73.4	v1.74.1 — exactly what sqlite v1.55.0 pins (lockstep), not libc's own latest v1.74.4
`github.com/prometheus/client_golang`	v1.23.2	v1.24.1
`go.yaml.in/yaml/v2`	v2.4.2	v2.4.4

Plus the transitive pins go mod tidy recomputed: jwt/v5 v5.3.1, go-isatty v0.0.23, prometheus/common v0.70.1, procfs v0.21.1, go-retry v0.4.0, x/sync v0.22.0; kr/text dropped.

Deviation from the issue: goose stays at v3.27.2

The sixth target, goose/v3 v3.27.3, is structurally incompatible with the sqlite/libc lockstep: its own go.mod requires modernc.org/libc v1.74.3, which upstream retracted ("freeaddrinfo leaks a locked ___lock entry; deadlocks name resolution, fixed in v1.74.4"). Taking goose v3.27.3 forces libc to a retracted, deadlock-prone version — or past it to v1.74.4, violating the lockstep the issue rightly flags as hard. goose v3.27.3 contains only "various dependency upgrades" (the very ones that create the conflict), so nothing is lost. Full analysis in the issue comment; the daily schedule will pick the bump up once upstream unblocks it.

Also per the issue's scope: golang.org/x/crypto stays at v0.52.0 (go get had moved it opportunistically to v0.54.0; reverted — nothing in the module graph requires more than v0.52.0, and all 2026 x/crypto advisories are fixed at our pin).

Compatibility checks from the issue, re-verified

The SQLite DSN recipe (internal/store/store.go:85-86) is untouched and still uses the _pragma=name(value) form + _txlock=immediate — none of sqlite v1.55.0's newly-honored mattn shorthand keys appear in it.
NameValidationScheme is unset anywhere in the repo; we import only prometheus, promhttp, collectors — client_golang v1.24's breaking changes don't reach us. The metrics test asserting lab_http_requests_total / go_goroutines passes unchanged.

Verification (Go 1.26.5, this branch)

go build ./... — clean
go test ./... — all 47 packages ok, no skips
golangci-lint run (2.12.2, the CI-pinned version) — 0 issues
govulncheck ./... — no findings; GO-2026-5970 confirmed gone. The only module-level, not-called mention is GO-2026-5932 (x/crypto/openpgp permanently unmaintained, no fixed version, package not imported) — pre-existing and expected per the issue.
vendorHash in nix/package.nix regenerated in the same commit. No nix exists in the run environment, so the hash was computed by replicating the nixpkgs goModules fixed-output derivation (goSrc fileset → go mod vendor under the builder's exact env → NAR/sha256 SRI) against the pinned nixpkgs rev d407951. The method was validated by reproducing the previous pinned hash bit-for-bit from the pre-bump go.sum before computing the new one, and the result was determinism-checked across two runs. The ci-nix gate (nix flake check) is the authoritative hermetic verification on this PR.

🤖 Generated with Claude Code

Closes #250 ## What moved | Module | Before | After | |---|---|---| | `golang.org/x/text` (indirect) | v0.38.0 | **v0.40.0** — closes **GO-2026-5970** | | `modernc.org/sqlite` | v1.53.0 | **v1.55.0** | | `modernc.org/libc` (indirect) | v1.73.4 | **v1.74.1** — exactly what sqlite v1.55.0 pins (lockstep), *not* libc's own latest v1.74.4 | | `github.com/prometheus/client_golang` | v1.23.2 | **v1.24.1** | | `go.yaml.in/yaml/v2` | v2.4.2 | **v2.4.4** | Plus the transitive pins `go mod tidy` recomputed: `jwt/v5` v5.3.1, `go-isatty` v0.0.23, `prometheus/common` v0.70.1, `procfs` v0.21.1, `go-retry` v0.4.0, `x/sync` v0.22.0; `kr/text` dropped. ## Deviation from the issue: goose stays at v3.27.2 The sixth target, `goose/v3` v3.27.3, is **structurally incompatible** with the sqlite/libc lockstep: its own go.mod requires `modernc.org/libc v1.74.3`, which upstream **retracted** ("freeaddrinfo leaks a locked ___lock entry; deadlocks name resolution, fixed in v1.74.4"). Taking goose v3.27.3 forces libc to a retracted, deadlock-prone version — or past it to v1.74.4, violating the lockstep the issue rightly flags as hard. goose v3.27.3 contains only "various dependency upgrades" (the very ones that create the conflict), so nothing is lost. Full analysis in the issue comment; the daily schedule will pick the bump up once upstream unblocks it. Also per the issue's scope: `golang.org/x/crypto` stays at v0.52.0 (`go get` had moved it opportunistically to v0.54.0; reverted — nothing in the module graph requires more than v0.52.0, and all 2026 x/crypto advisories are fixed at our pin). ## Compatibility checks from the issue, re-verified - The SQLite DSN recipe (`internal/store/store.go:85-86`) is untouched and still uses the `_pragma=name(value)` form + `_txlock=immediate` — none of sqlite v1.55.0's newly-honored mattn shorthand keys appear in it. - `NameValidationScheme` is unset anywhere in the repo; we import only `prometheus`, `promhttp`, `collectors` — client_golang v1.24's breaking changes don't reach us. The metrics test asserting `lab_http_requests_total` / `go_goroutines` passes unchanged. ## Verification (Go 1.26.5, this branch) - `go build ./...` — clean - `go test ./...` — all 47 packages ok, no skips - `golangci-lint run` (2.12.2, the CI-pinned version) — 0 issues - `govulncheck ./...` — **no findings; GO-2026-5970 confirmed gone.** The only module-level, not-called mention is GO-2026-5932 (`x/crypto/openpgp` permanently unmaintained, no fixed version, package not imported) — pre-existing and expected per the issue. - `vendorHash` in `nix/package.nix` regenerated **in the same commit**. No nix exists in the run environment, so the hash was computed by replicating the nixpkgs `goModules` fixed-output derivation (goSrc fileset → `go mod vendor` under the builder's exact env → NAR/sha256 SRI) against the pinned nixpkgs rev `d407951`. The method was validated by reproducing the previous pinned hash bit-for-bit from the pre-bump `go.sum` before computing the new one, and the result was determinism-checked across two runs. The `ci-nix` gate (`nix flake check`) is the authoritative hermetic verification on this PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-07-31 05:12:41 +02:00

chore(deps): x/text v0.40.0 (GO-2026-5970), sqlite v1.55.0 + libc v1.74.1 lockstep, client_golang v1.24.1, yaml v2.4.4

ci / native (pull_request) Successful in 12m10s

Details

ci-nix / flake-check (pull_request) Successful in 21m58s

Details

3aab487345

Move four of issue #250's five module targets and regenerate the shared
nix vendorHash in the same commit:

- golang.org/x/text v0.38.0 -> v0.40.0: closes advisory GO-2026-5970
  (infinite loop in unicode/norm); govulncheck reports no findings.
- modernc.org/sqlite v1.53.0 -> v1.55.0 with modernc.org/libc at
  v1.74.1, exactly the version sqlite v1.55.0's go.mod pins (upstream
  lockstep requirement) - deliberately not libc's own latest v1.74.4.
- github.com/prometheus/client_golang v1.23.2 -> v1.24.1.
- go.yaml.in/yaml/v2 v2.4.2 -> v2.4.4.
- Transitive pins moved by go mod tidy: jwt/v5 v5.3.1, go-isatty
  v0.0.23, prometheus/common v0.70.1, procfs v0.21.1, go-retry v0.4.0,
  x/sync v0.22.0; kr/text dropped from the pruned graph.

github.com/pressly/goose/v3 stays at v3.27.2: v3.27.3's own go.mod
requires modernc.org/libc v1.74.3, which upstream retracted for a
name-resolution deadlock and which conflicts with the sqlite lockstep
pin (finding recorded on #250). golang.org/x/crypto stays at v0.52.0
per the issue's scope; go get had moved it opportunistically and
nothing in the module graph requires more.

The SQLite DSN recipe in internal/store/store.go is untouched; it uses
the _pragma=name(value) form, so sqlite v1.55.0's newly-honored mattn
shorthand DSN keys change nothing for us.

vendorHash regenerated for the new go.sum by replicating the nixpkgs
goModules fixed-output derivation (go mod vendor + NAR/sha256); the
method was validated by reproducing the previous pinned hash from the
pre-bump go.sum bit-for-bit. The ci-nix gate verifies it hermetically.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dominik.polakovics commented

2026-07-31 05:35:10 +02:00

Author

Owner

[autoland] verdict: pass