fix(security): Backport security updates to release-3.6.x - #23403
Merged
Conversation
jnewbigin
requested review from
a team,
JoaoBraveCoding,
periklis,
trevorwhitney and
xperimental
as code owners
July 22, 2026 11:42
This was referenced Jul 22, 2026
jnewbigin
force-pushed
the
jnewbigin/security-backports-3.6.x
branch
from
July 22, 2026 11:46
ce27904 to
faba8fe
Compare
jnewbigin
changed the title
…ive to v1.25.12 [SECURITY] | datasource | package | from | to | | -------------- | ------- | ------- | ------- | | golang-version | go | 1.25.11 | 1.25.12 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
…v1.82.1 [SECURITY]
…oogle.golang.org/grpc [SECURITY] Bumps the main module's vulnerable direct dependencies to their fixed versions and re-runs go mod tidy + go mod vendor: - google.golang.org/grpc v1.81.1 => v1.82.1 (GHSA-hrxh-6v49-42gf) - golang.org/x/net v0.55.0 => v0.56.0 (CVE-2026-46600) - golang.org/x/text v0.37.0 => v0.39.0 (CVE-2026-56852) The re-tidy also advances several transitive dependencies to the versions selected by the current module graph.
… to fix prometheus and golang.org/x/text [SECURITY] Adds a replace directive for github.com/grafana/loki/pkg/push => ../../pkg/push so the tool builds against the in-repo modules (it already replaced github.com/grafana/loki/v3). Re-running go mod tidy then advances the flagged dependencies to fixed versions via the main module's graph: - github.com/prometheus/prometheus => v0.312.1 (CVE-2026-42154, CVE-2026-42151, CVE-2026-44903) - golang.org/x/text v0.35.0 => v0.39.0 (CVE-2026-56852)
jnewbigin
force-pushed
the
jnewbigin/security-backports-3.6.x
branch
from
July 22, 2026 23:20
e11bfda to
b3ae263
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security backports for
release-3.6.x. Renovate is currently not operational, so these were reproduced locally: toolchain bumps are verbatim cherry-picks of the Renovate commits; module updates were applied withgo get <module>@<version>+go mod tidy(+go mod vendorfor the main module).Addresses the outstanding findings from the Vulnerability Observability report for this line, plus the previously-open Renovate security PRs.
Main module (
go.mod) — affects the shipped binarygolang.org/x/net→ v0.56.0 (CVE-2026-46600)golang.org/x/text→ v0.39.0 (CVE-2026-56852)google.golang.org/grpc→ v1.82.1 (GHSA-hrxh-6v49-42gf)go mod tidy+go mod vendor(advances several transitive deps to the graph-selected versions)pkg/push(published module; consumed in-repo viareplace)google.golang.org/grpc→ v1.82.1,golang.org/x/net→ v0.56.0,golang.org/x/text→ v0.39.0cmd/dataobj-inspectreplace .../pkg/push => ../../pkg/push); pullsprometheus→ v0.312.1 (CVE-2026-42154/42151/44903) andgolang.org/x/text→ v0.39.0Operator (
operator,operator/api/loki)go.opentelemetry.io/otel→ v1.41.0 (HIGH)golang.org/x/crypto→ v0.52.0,golang.org/x/net→ v0.55.0,golang.org/x/sys→ v0.44.0operator/api/loki:golang.org/x/net→ v0.55.0Not addressed here
github.com/docker/docker(CVE-2026-34040, CVE-2026-33997) — fix is Docker Engine 29.3.1, which is not published on thegithub.com/docker/dockerGo module path (tops out at v28.5.2+incompatible); needs a module-path change, out of scope for a dep bump.cmd/segment-inspectgrpc/x/net/x/text — the tool is stale and unbuildable (importsgithub.com/grafana/loki/v3/pkg/storage/wal, which no longer exists), sogotooling cannot tidy/bump it.golang.org/x/crypto/openpgpGO-2026-5932.Verification
go build ./...passes for the main module and updated submodules;go mod tidyis a clean no-op andgo mod verifypasses.Supersedes the equivalent Renovate PRs: #23132, #23133, #23156, #23160, #23161, #23162, #23174.