tasker
tasker is a durable http task queue service
Star 1
Fork 0
Watch

Fix reported Go and x/net vulnerabilities #5

Merged kenneth.nym.sh
targeting main from t3/fix-go-vulnerabilities
Merged opened by and assigned to kenneth.nym.sh
targeting main from t3/fix-go-vulnerabilities

Upgrade golang.org/x/net from v0.59.0 to v0.62.0 to address CVE-2026-78663, CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-97032, CVE-2026-78661, and CVE-2026-97045. This also updates its required golang.org/x/text dependency to v0.43.0.

Raise the minimum Go version and Docker builder to Go 1.26.10 to address CVE-2026-111943. Existing CI and local Go toolchain selection follow go.mod.

Fix a log-capture race exposed during validation: the E2E internal-error test now waits for subprocess output before checking the request ID.

Validation:

  • nix develop -c go test ./... -count=1 -timeout=5m
  • nix develop -c go test ./tests/e2e -run '^TestAPIInternalErrorCodes$' -count=20 -timeout=2m
  • nix develop -c go mod verify
  • nix develop -c go run golang.org/x/vuln/cmd/govulncheck@latest ./... — no vulnerabilities found.
  • Docker image build and the existing container smoke test.
Commits 0