fix: upgrade extras/dagger golang.org/x/text to v0.39.0

Merged
CH
3mo ago
+6-2

Summary

Updated the nested extras/dagger Go module to use golang.org/x/text v0.39.0, which contains the fix for the normalization iterator infinite-loop issue. The module graph also moved golang.org/x/sync to v0.21.0 as a transitive requirement of the patched golang.org/x/text release.

Vulnerability Fixed

GO-2026-5970-golang.org/x/text (HIGH): norm.Iter could enter an infinite loop when handling invalid UTF-8 bytes.

Changes Made

  • Bumped golang.org/x/text in extras/dagger/go.mod from v0.37.0 to v0.39.0, the first fixed release identified by the assessment.
  • Refreshed extras/dagger/go.sum with checksums for the patched dependency version.
  • Accepted the resolver-driven golang.org/x/sync v0.20.0 -> v0.21.0 update because golang.org/x/text v0.39.0 now requires that newer transitive version.

Verification

Ran syft dir:extras/dagger -o cyclonedx-json=/tmp/chainloop-sbom.json and GRYPE_DB_AUTO_UPDATE=false grype sbom:/tmp/chainloop-sbom.json --only-fixed -o json. Outcome: resolved — grype no longer reports GO-2026-5970-golang.org/x/text for the patched module.

Risk Assessment

View the risk assessment in Chainloop