fix: upgrade golang.org/x/mod to v0.40.0

Merged
CH
2mo ago
+15-15

Summary

Upgraded the indirect Go module dependency golang.org/x/mod from v0.38.0 to v0.40.0, the first fixed release identified by the assessment hint and module metadata. This keeps the change scoped to the vulnerable component while preserving the rest of the dependency graph.

Vulnerability Fixed

GO-2026-6179-golang.org/x/mod (HIGH): a malicious GOPROXY could previously forge up to two sumdb tiles and bypass GOSUMDB verification, allowing attacker-controlled module content to persist in a local Go module cache.

Changes Made

  • Updated golang.org/x/mod in go.mod from v0.38.0 to v0.40.0, the fixed release for this advisory.
  • Added the corresponding v0.40.0 checksums to go.sum so the patched module resolves reproducibly without changing unrelated dependencies.
  • Verified that v0.40.0 is an available upstream release before applying the bump.

Verification

Ran syft dir:. -o cyclonedx-json=/tmp/chainloop-sbom.json followed by grype sbom:/tmp/chainloop-sbom.json --only-fixed -o json against the patched repository. Outcome: resolved — grype no longer reports GO-2026-6179-golang.org/x/mod for the scanned source tree.

Risk Assessment

View the risk assessment in Chainloop