rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump golang.org/x/image to v0.43.0 for CVEs

Browse Source 
Upgrade golang.org/x/image from v0.41.0 to v0.43.0 to remediate two
vulnerabilities: CVE-2026-33813 (denial of service via malformed WEBP
parsing, fixed in v0.42.0) and CVE-2026-46602 (missing limit on tile
sizes in x/image/tiff, fixed in v0.43.0). The bump also pulls in
golang.org/x/text v0.38.0 transitively.

Signed-off-by: Émile Ré <emile@probo.com>
This commit is contained in:
Émile Ré
2026-06-23 11:54:43 +02:00
parent 14aa6c3196
commit 21c089399e
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
go.mod
View File

@@ -43,7 +43,7 @@ require (
go.opentelemetry.io/otel/trace v1.44.0
go.probo.inc/mcpgen v0.0.0-20260428172408-1496ba9b4619
golang.org/x/crypto v0.52.0
golang.org/x/image v0.41.0
golang.org/x/image v0.43.0
golang.org/x/oauth2 v0.36.0
golang.org/x/sync v0.21.0
google.golang.org/api v0.283.0
@@ -248,7 +248,7 @@ require (
golang.org/x/net v0.55.0
golang.org/x/sys v0.45.0 // indirect
golang.org/x/term v0.43.0
golang.org/x/text v0.37.0 // indirect
golang.org/x/text v0.38.0 // indirect
golang.org/x/tools v0.45.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect