Repository navigation
[BEE-1472] Security fix service binary in localstack docker desktop - #114
Merged
jbeemster merged 1 commit intoNov 4, 2026
Conversation
Bumps golang.org/x/net to v0.62.0, clearing CVE-2026-78661 and CVE-2026-97045. Bumps golang.org/x/crypto to v0.58.1-0.20261009181718-2f1f834330b2, clearing GO-2026-5932 (openpgp is unmaintained). The fix is the upstream commit that moved openpgp out of x/crypto into its own module; it landed after v0.58.0 and no tagged release includes it yet, so this is a pseudo-version. The service does not import openpgp. Dependabot will move it to a tag once v0.59.0 is released. x/sys and x/text move with them as MVS requirements. Verified with trivy: service gobinary goes from 4 findings to 1. The remainder is CVE-2026-55677 against echo v3.3.10+incompatible, which has no fixed version for the v3 module path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps golang.org/x/net to v0.62.0, clearing CVE-2026-78661 and CVE-2026-97045.
Bumps golang.org/x/crypto to v0.58.1-0.20261009181718-2f1f834330b2, clearing GO-2026-5932 (openpgp is unmaintained). The fix is the upstream commit that moved openpgp out of x/crypto into its own module; it landed after v0.58.0 and no tagged release includes it yet, so this is a pseudo-version. The service does not import openpgp. Dependabot will move it to a tag once v0.59.0 is released.
x/sys and x/text move with them as MVS requirements.
Verified with trivy: service gobinary goes from 4 findings to 1. The remainder is CVE-2026-55677 against echo v3.3.10+incompatible, which has no fixed version for the v3 module path.