Skip to content

deps: Go toolchain 1.27.3, rustls-webpki 0.103.16 for new advisories (main) - #664

Merged
EricAndrechek merged 1 commit into
mainfrom
main-advisories-1021
Oct 21, 2026
Merged

EricAndrechek merged 1 commit into
mainfrom
main-advisories-1021

Conversation

@EricAndrechek

Copy link
Copy Markdown
Member

New upstream advisories reported by the report-only security job. Lockfile and toolchain-directive changes only.

  • Go: GO-2026-6809 (crypto/x509, distrust of compromised intermediates; fixed in Go 1.27.3). toolchain go1.27.2 -> go1.27.3 in go/go.mod, examples/go/go.mod, scripts/fetch-v1/genfixtures/go.mod and scripts/fetch-v1/refcheck/go/go.mod; the go directive is unchanged. CI's setup-go reads these files. go test ./... in go/ passes locally on go1.27.3.
  • TS: nothing to change on this branch. pnpm audit is already clean in ts/ and examples/ts/ here (vite is already 8.3.4).
  • Rust: RUSTSEC-2026-0382 (rustls-webpki 0.103.15 -> 0.103.16), RUSTSEC-2026-0383 (webpki-root-certs 1.0.9 -> 1.0.10) and RUSTSEC-2026-0381 (webpki-roots 1.0.9 -> 1.0.10), via cargo update --precise in rust/ and examples/rust/ (lockfiles only).

TS and Rust are verified by CI; no local build.

🤖 Generated with Claude Code

…(main)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@EricAndrechek
EricAndrechek added this pull request to the merge queue Oct 21, 2026
Merged via the queue into main with commit 36d24ca Oct 21, 2026
51 of 52 checks passed
@EricAndrechek
EricAndrechek deleted the main-advisories-1021 branch October 21, 2026 04:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant