fix(deps): update module golang.org/x/net to v0.33.0 [security]
Metadata
Current evaluation
Merged as commit 66fe12f, upgrading golang.org/x/net from v0.30.0 to v0.33.0 to address CVE-2024-45338; shipped in v0.6.0.
Resolution: closed resolved
Reason: PR #318 was merged as commit 66fe12f after approval. The security dependency update fixed the x/net denial-of-service vulnerability and was recorded in the v0.6.0 changelog.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| golang.org/x/net | `v0.30.0` -> `v0.33.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338)
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/fetch-service).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS43Mi41IiwidXBkYXRlZEluVmVyIjoiMzkuNzIuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 66fe12f, upgrading golang.org/x/net from v0.30.0 to v0.33.0 to address CVE-2024-45338; shipped in v0.6.0. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged as canonical/fetch-service#318, updating golang.org/x/net to v0.33.0 to address CVE-2024-45338 and its DoS risk. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated update to golang.org/x/net v0.33.0, patching CVE-2024-45338 denial-of-service vulnerability. Also updated golang.org/x/crypto, golang.org/x/sys, and golang.org/x/text. Approved by reviewers and passed CI. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #86 fix(deps): update module golang.org/x/net to v0.23.0 [security] | fetch-service | merged | Merged PR #86 (commit a461af7), upgrading golang.org/x/net from v0.22.0 to v0.23.0 to address CVE-2023-45288. | |
| #287 fix(deps): update module golang.org/x/net to v0.33.0 - autoclosed | fetch-service | closed | Renovate PR to bump golang.org/x/net v0.30.0 -> v0.33.0 was autoclosed as a duplicate of security PR #318, which merged as commit 66fe12f with the same v0.33.0 update. | |
| #321 fix(deps): update module golang.org/x/net to v0.35.0 | fetch-service | merged | Renovate PR merged as commit 560fcab, bumping golang.org/x/net v0.33.0 -> v0.35.0 in go.mod/go.sum plus transitive x/crypto v0.33.0, x/sys v0.30.0, x/text v0.22.0. | |
| #471 fix(deps): update module golang.org/x/net to v0.46.0 | fetch-service | merged | Renovate dependency bump of golang.org/x/net v0.45.0 -> v0.46.0 merged into main (approved by 2 reviewers, all CI green) via commit 80d3332. | |
| #406 fix(deps): update module golang.org/x/net to v0.42.0 | fetch-service | merged | Renovate dependency bump merged: golang.org/x/net updated v0.41.0 -> v0.42.0 in go.mod/go.sum via commit 56f55f9, approved by 2 reviewers with all CI checks green. | |
| #205 fix(deps): update module golang.org/x/net to v0.30.0 | fetch-service | merged | Renovate PR merged, bumping golang.org/x/net v0.28.0 → v0.30.0 (plus x/crypto v0.28.0, x/sys v0.26.0, x/text v0.19.0) via merge commit 75380f2, later released in v0.3.0 (#261). | |
| #454 fix(deps): update module golang.org/x/net to v0.44.0 | fetch-service | closed | Renovate PR bumping golang.org/x/net v0.43.0->v0.44.0 was closed unmerged and superseded by #468, which merged as 957f5d6 with a direct bump to v0.45.0. | |
| #359 fix(deps): update module golang.org/x/net to v0.38.0 [security] - autoclosed | fetch-service | closed | Renovate's x/net v0.38.0 security bump was autoclosed unmerged: `go get` for go.sum failed downloading go1.23.10 (GOSUMDB=off). The same bump landed later via merged PR #387 (commit 52444a8). | |
| #468 fix(deps): update module golang.org/x/net to v0.45.0 | fetch-service | merged | Renovate dependency bump of golang.org/x/net v0.43.0 -> v0.45.0 merged to main via commit 957f5d6 (go.mod/go.sum, +12/-4), also pulling x/crypto v0.42.0, x/sys v0.36.0, x/text v0.29.0. | |
| #138 fix(deps): update module golang.org/x/net to v0.27.0 | fetch-service | merged | Renovate PR merged into main as commit 2657256, bumping golang.org/x/net v0.26.0 -> v0.27.0 in go.mod/go.sum, with transitive bumps of golang.org/x/crypto v0.25.0 and golang.org/x/sys v0.22.0. |