pingcap / pingcap/tidb-dashboard
build(deps): bump golang.org/x/net to v0.55.0
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 204
- Forks
- 158
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 8
Description
Fixes https://github.com/advisories/GHSA-w2q5-6q6x-x959 (GO-2026-5026): golang.org/x/net/idna ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only label, which can lead to privilege escalation in programs performing hostname-based checks.
x/net v0.55.0 implements UTS 46 revision 33 which fixes the underlying specification bug. 'go mod tidy' updates the transitive golang.org/x/* modules (crypto, mod, sync, sys, text, tools) to satisfy x/net's minimum requirements.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running go mod tidy to update golang.org/x/net to v0.55.0 and satisfy its minimum requirements for the related golang.org/x/* modules. Confirm the advisory GHSA-w2q5-6q6x-x959 is addressed and that the resulting dependency updates pass the project's checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100