[🧹 CHORE]: Fix CVE-2026-39822 CVE-2026-33630 CVE-2026-45045 CVE-2026-42505 GO-2026-5932

[dmitryuk]

No duplicates 🥲.

• I have searched for a similar issue.

What should be improved or cleaned up?

Hello. Critical issues must be fixed CVE-2026-39822 CVE-2026-33630 CVE-2026-45045 CVE-2026-42505 GO-2026-5932
Packages: stdlib, c-ares, github.com/gofiber/fiber/v2, golang.org/x/crypto
Thanks

[rustatian]

Hey @dmitryuk 👋🏻
Thank you for the report 👍🏻
We're not using these methods from go-fiber, all go-fiber stuff is located in 1 plugin - fileserver, which is turned off by default.
For other cve's, let's wait when they'll be fixed.

[nishatbaig]

findings from the current RoadRunner main branch go.mod:

Dependency	CVE Version	Current main	Fixed Version	Status
Go stdlib	1.26.4	1.26.4	1.26.6+	⚠️ Still vulnerable
grpc	1.81.1	1.83.0	1.82.1+	✅ Fixed on main
x/text	0.38.0	0.41.0	0.39.0+	✅ Fixed on main
x/crypto	0.53.0	0.55.0	(unknown)	✅ Likely fixed
gofiber/fiber	2.52.13	2.52.15	2.52.14+	✅ Fixed on main

The only thing that is pending is to update the go version in go.mod.

Fixing it here #2379

The PR is AI assisted but I have reviewed the code before pushing it. Also made sure the tests pass.
Let me know if I am missing anything here.

[dmitryuk]

Thanks a lot! Can you roll-out a new release?

[rustatian]

You're welcome, @dmitryuk. The next release will be v3 in a few weeks.