security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-5cv4-jp36-h3mw	golang.org/x/net	None	v0.46.1-0.20251013234738-63d1a5100f82	0.55.0		confirmed

Not Included

• Deferred by batch limit: 28 advisories. They will be considered by future runs.
• Other deferred scanner findings: 135.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	al.essio.dev/pkg/shellescape	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/AdaLogics/go-fuzz-headers	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Azure/go-ansiterm	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Code-Hex/go-infinity-channel	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Code-Hex/vz/v3	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	go.yaml.in/yaml/v3	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	gotest.tools/v3	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Microsoft/go-winio	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/apapsch/go-jsonmerge/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/cespare/xxhash/v2	Non-CVE alert is not handled by dependency remediation.
...	...	125 additional items omitted from PR body. See workflow artifacts for full details.

---

Note

Medium Risk
Upgrading golang.org/x/net and aligned x/sys/x/crypto modules can subtly change HTTP and networking behavior even without code edits; worth a quick smoke test on ingress/API paths.

Overview
Addresses GHSA-5cv4-jp36-h3mw by upgrading golang.org/x/net from a pre-release v0.46.1-0.20251013… pin to v0.55.0 in go.mod, with matching checksum updates in go.sum.

The same pass refreshes related golang.org/x/* modules: direct bumps for sync (v0.17.0 → v0.20.0) and sys (v0.38.0 → v0.45.0), plus indirect crypto, mod, text, and tools. There are no application source changes; the large go.sum diff is mostly newly recorded transitive modules from go mod resolution.

The repo’s only direct x/net import is golang.org/x/net/http/httpguts in ingress handling, so runtime impact is limited to whatever behavior fixes ship in the newer networking stack.

^{Reviewed by Cursor Bugbot for commit 33d6bcb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​net@​v0.46.1-0.20251013234738-63d1a5100f82 ⏵ v0.55.0		+2
	golang.org/​x/​sys@​v0.38.0 ⏵ v0.45.0
	golang.org/​x/​sync@​v0.17.0 ⏵ v0.20.0

View full report

[ulziibay-kernel]

Bumped to otel 1.44.0 so this also covers CVE-2026-29181, which needs 1.41.0 and was not addressed by the original 1.40.0 bump. Realigned the semconv import to v1.41.0 to fix the conflicting schema URL that was breaking every lib/otel test. test and test-darwin now pass.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 085a672. Configure here.}

[cursor]

Failed OTel CVE remediation

High Severity

This PR claims a confirmed fix for GHSA-9h8m-3fm2-qjrq by moving go.opentelemetry.io/otel/sdk to 1.43.0, but go.mod and go.sum still pin v1.38.0 with no 1.40+ checksums. otel.Init still calls resource.Default(), so Darwin builds remain exposed to the ioreg PATH-hijack ACE. Unrelated golang.org/x/* bumps landed instead.

Additional Locations (1)

• go.mod#L58-L61

 

^{Reviewed by Cursor Bugbot for commit 085a672. Configure here.}