opensource/hoppscotch
3
0
Fork 0
mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-10-24 12:11:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(docker): raise x/net and x/text pins so grpc and x/crypto upgrades stick

Browse Source 
The older x/net v0.56.0 and x/text v0.39.0 pins ran after the grpc v1.83.2
and x/crypto v0.56.0 upgrades and forced them back down to v1.83.1 and
v0.53.0. Bump them to v0.58.0 and v0.41.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
“mirarifhasan”
2026-09-28 14:54:43 +06:00
co-authored by Claude Opus 5.5
parent daf40aa70e
commit c5b4f26e1d
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prod.Dockerfile
+4 -4
View File
@@ -45,10 +45,10 @@ RUN tar -xzf /tmp/caddy-build/src.tar.gz && \
go get golang.org/x/crypto@v0.56.0 && \
# Fix CVE-2026-34986: upgrade go-jose v3 (HIGH - DoS via crafted JWE)
go get github.com/go-jose/go-jose/v3@v3.0.5 && \
# Fix CVE-2026-46600: upgrade golang.org/x/net v0.56.0 (HIGH - panic on invalid DNS RR)
go get golang.org/x/net@v0.56.0 && \
# Fix CVE-2026-56852: upgrade golang.org/x/text v0.39.0 (HIGH - infinite loop on input)
go get golang.org/x/text@v0.39.0 && \
# Fix CVE-2026-46600: upgrade golang.org/x/net v0.58.0 (HIGH - panic on invalid DNS RR)
go get golang.org/x/net@v0.58.0 && \
# Fix CVE-2026-56852: upgrade golang.org/x/text v0.41.0 (HIGH - infinite loop on input)
go get golang.org/x/text@v0.41.0 && \
# Clean up any existing vendor directory and regenerate with updated deps
rm -rf vendor && \
go mod tidy && \