Skip to content

Resolve CVE-2024 Security Issue: Upgrade golang.org/x/net to v0.42.0 and Clean Dependencies #106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ernest-phillips merged 3 commits into from
Aug 21, 2025
Merged

Resolve CVE-2024 Security Issue: Upgrade golang.org/x/net to v0.42.0 and Clean Dependencies #106

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
41e1bbc
Add replace directive to force golang.org/x/net v0.42.0 for CVE-2024-…
ernest-phillips Aug 6, 2025
0f678da
resolve the version mismatch and unknown directive errors
ernest-phillips Aug 6, 2025
2f88303
Fix go.mod: set go 1.23 and remove unsupported toolchain directive fo…
ernest-phillips Aug 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/go.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,10 @@ jobs:
runs-on: ${{ matrix.os }}

steps:
- name: Set up Go 1.19
- name: Set up Go 1.23
Copy link
Contributor

@smashwilson smashwilson Aug 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the Go upgrade necessary to upgrade the module?

Copy link
Contributor Author

@ernest-phillips ernest-phillips Aug 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I looked into the requirements for the golang.org/x/net v0.42.0 upgrade. It turns out that Go 1.23 is the minimum required version, as specified by the module’s go.mod file:

go 1.23

https://github.com/golang/net/blob/v0.42.0/go.mod

uses: actions/setup-go@v3
with:
go-version: 1.19
go-version: 1.23

- name: Check out code
uses: actions/checkout@v3
Expand All @@ -36,4 +36,4 @@ jobs:
run: go test -race ./...

- name: Build
run: go build -v .
run: go build -v .
16 changes: 10 additions & 6 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
module github.com/github/gh-classroom

go 1.21
go 1.23.0

toolchain go1.24.5

require (
github.com/AlecAivazis/survey/v2 v2.3.6
Expand Down Expand Up @@ -61,10 +63,12 @@ require (
github.com/yuin/goldmark v1.4.13 // indirect
github.com/yuin/goldmark-emoji v1.0.1 // indirect
github.com/zalando/go-keyring v0.2.2 // indirect
golang.org/x/net v0.23.0 // indirect
golang.org/x/sync v0.1.0 // indirect
golang.org/x/sys v0.18.0 // indirect
golang.org/x/term v0.18.0 // indirect
golang.org/x/text v0.14.0 // indirect
golang.org/x/net v0.42.0 // indirect
golang.org/x/sync v0.16.0 // indirect
golang.org/x/sys v0.34.0 // indirect
golang.org/x/term v0.33.0 // indirect
golang.org/x/text v0.27.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)

replace golang.org/x/net => golang.org/x/net v0.42.0
Loading
Loading