fix: bump extras/dagger golang.org/x/text to v0.39.0

Closed
CH
3mo ago
+6-2

Summary

Bump the helper module under extras/dagger from golang.org/x/text v0.37.0 to v0.39.0, which is the first fixed release for GO-2026-5970. This aligns the helper module with the already-patched root module and removes the vulnerable version from the dependency graph.

Vulnerability Fixed

GO-2026-5970-golang.org/x/text (HIGH) - norm.Iter can enter an infinite loop when handling invalid UTF-8 bytes in releases before golang.org/x/text v0.39.0.

Changes Made

  • Updated extras/dagger/go.mod to require golang.org/x/text v0.39.0 instead of v0.37.0.
  • Refreshed extras/dagger/go.sum for the patched module version; go get also lifted the indirect golang.org/x/sync entry to v0.21.0 during module resolution.
  • Kept the fix scoped to the extras/dagger helper module because the repository root already pins golang.org/x/text v0.39.0.

Verification

Ran syft dir:/workspace/run/repo -o cyclonedx-json=/tmp/chainloop-sbom.json && grype sbom:/tmp/chainloop-sbom.json --only-fixed -o json against the patched repository. Verification outcome: resolved - GO-2026-5970-golang.org/x/text is no longer reported in the generated SBOM scan.

Risk Assessment

View the risk assessment in Chainloop