build(deps): bump golang.org/x/net from 0.22.0 to 0.23.0
Metadata
Current evaluation
Dependabot's golang.org/x/net 0.22.0→0.23.0 bump (fetch-service#85) was closed unmerged as superseded by the security fix PR #86, merged in commit a461af7.
Resolution: closed superseded
Reason: Maintainer cmatsuoka closed the PR on 2024-06-13 with the comment "Superseded by #86" and dependabot confirmed. PR #86 ("fix(deps): update module golang.org/x/net to v0.23.0 [security]") was merged, bumping go.mod/go.sum to v0.23.0 in commit a461af7.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.22.0 to 0.23.0.
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/golang/net/commit/c48da131589f122489348be5dfbcb6457640046f"><code>c48da13</code></a> http2: fix TestServerContinuationFlood flakes</li>
<li><a href="https://github.com/golang/net/commit/762b58d1cf6e0779780decad89c6c1523386638d"><code>762b58d</code></a> http2: fix tipos in comment</li>
<li><a href="https://github.com/golang/net/commit/ba872109ef2dc8f1da778651bd1fd3792d0e4587"><code>ba87210</code></a> http2: close connections when receiving too many headers</li>
<li><a href="https://github.com/golang/net/commit/ebc8168ac8ac742194df729305175940790c55a2"><code>ebc8168</code></a> all: fix some typos</li>
<li><a href="https://github.com/golang/net/commit/3678185f8a652e52864c44049a9ea96b7bcc066a"><code>3678185</code></a> http2: make TestCanonicalHeaderCacheGrowth faster</li>
<li><a href="https://github.com/golang/net/commit/448c44f9287b6745f958d74aa2a17ec7761c2f13"><code>448c44f</code></a> http2: remove clientTester</li>
<li><a href="https://github.com/golang/net/commit/c7877ac4213b2f859831366f5a35b353e0dc9f66"><code>c7877ac</code></a> http2: convert the remaining clientTester tests to testClientConn</li>
<li><a href="https://github.com/golang/net/commit/d8870b0bf2f2426fc8d19a9332f652da5c25418f"><code>d8870b0</code></a> http2: use synthetic time in TestIdleConnTimeout</li>
<li><a href="https://github.com/golang/net/commit/d73acffdc9493532acb85777105bb4a351eea702"><code>d73acff</code></a> http2: only set up deadline when Server.IdleTimeout is positive</li>
<li><a href="https://github.com/golang/net/commit/89f602b7bbf237abe0467031a18b42fc742ced08"><code>89f602b</code></a> http2: validate client/outgoing trailers</li>
<li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.22.0...v0.23.0">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
You can trigger a rebase of this PR by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/canonical/fetch-service/network/alerts).
</details>
> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | Dependabot's golang.org/x/net 0.22.0→0.23.0 bump (fetch-service#85) was closed unmerged as superseded by the security fix PR #86, merged in commit a461af7. | |
| stealth/space-bunny-alpha | — | closed superseded | Superseded by #86, which merged via commit a461af7 and upgraded golang.org/x/net from v0.22.0 to v0.23.0 to address CVE-2023-45288. | |
| qwen/qwen3.6-35b-a3b | — | — | Superseded by pull request #86. The Dependabot dependency bump for golang.org/x/net from 0.22.0 to 0.23.0 was closed without merging, as the update was handled through an alternative PR. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Superseded By:
canonical/fetch-service#86
(confidence 98%)
Security update PR merged in commit a461af7 performing the same x/net v0.23.0 upgrade (CVE-2023-45288).
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #358 build(deps): bump golang.org/x/net from 0.35.0 to 0.36.0 | fetch-service | closed | Dependabot's golang.org/x/net 0.35.0→0.36.0 bump was closed unmerged on 2025-06-24, superseded by PR #387 which updated x/net to 0.38.0 and merged in commit 52444a8. | |
| #387 build(deps): update golang.org/x/net to 0.38.0 | fetch-service | merged | Merged Dependabot-style bump of golang.org/x/net to v0.38.0 in go.mod/go.sum (commit 52444a8, 3 approvals); shipped in fetch-service 0.8.0 and later superseded by v0.42.0 (#406) and v0.43.0 (#436). | |
| #86 fix(deps): update module golang.org/x/net to v0.23.0 [security] | fetch-service | merged | Merged PR #86 (commit a461af7), upgrading golang.org/x/net from v0.22.0 to v0.23.0 to address CVE-2023-45288. | |
| #49 fix(deps): update module golang.org/x/net to v0.21.0 | fetch-service | merged | Renovate PR #49 merged as commit 6805fea, bumping golang.org/x/net from v0.17.0 to v0.21.0 in go.mod/go.sum. Approved by 2 reviewers; later superseded by #57 (v0.22.0) and #86 (v0.23.0). | |
| #454 fix(deps): update module golang.org/x/net to v0.44.0 | fetch-service | closed | Renovate PR bumping golang.org/x/net v0.43.0->v0.44.0 was closed unmerged and superseded by #468, which merged as 957f5d6 with a direct bump to v0.45.0. | |
| #33 build(deps): bump golang.org/x/net from 0.8.0 to 0.17.0 | fetch-service | merged | Merged PR #33 updated golang.org/x/net from 0.8.0 to 0.17.0 in commit 9a5ea82. | |
| #359 fix(deps): update module golang.org/x/net to v0.38.0 [security] - autoclosed | fetch-service | closed | Renovate's x/net v0.38.0 security bump was autoclosed unmerged: `go get` for go.sum failed downloading go1.23.10 (GOSUMDB=off). The same bump landed later via merged PR #387 (commit 52444a8). | |
| #70 fix(deps): update module golang.org/x/net to v0.24.0 - autoclosed | fetch-service | closed | Autoclosed unmerged; the dependency update was later superseded by merged PR #118 (697f4ff), which upgraded golang.org/x/net to v0.26.0. | |
| #287 fix(deps): update module golang.org/x/net to v0.33.0 - autoclosed | fetch-service | closed | Renovate PR to bump golang.org/x/net v0.30.0 -> v0.33.0 was autoclosed as a duplicate of security PR #318, which merged as commit 66fe12f with the same v0.33.0 update. | |
| #138 fix(deps): update module golang.org/x/net to v0.27.0 | fetch-service | merged | Renovate PR merged into main as commit 2657256, bumping golang.org/x/net v0.26.0 -> v0.27.0 in go.mod/go.sum, with transitive bumps of golang.org/x/crypto v0.25.0 and golang.org/x/sys v0.22.0. |