build(deps): remediate fixable Go vulnerabilities - #214
Merged
Merged
Conversation
Update the Go patch release and fixed dependency versions in both the root and system-test modules. This removes 17 of 22 reachable govulncheck findings while preserving the five findings that do not yet have published fixed releases.
Contributor
Author
|
Phase 2 tracking for the five residual no-published-fix findings: #215 |
j-rafique
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remediate the currently fixable reachable Go vulnerabilities without changing Lumera application logic.
This updates both Go modules in the repository:
1.26.2→1.26.6google.golang.org/grpcv1.80.0→v1.82.1golang.org/x/textv0.37.0→v0.39.0github.com/consensys/gnark-cryptov0.18.0→v0.18.1Changed files are limited to:
go.modgo.sumtests/systemtests/go.modtests/systemtests/go.sumThis is intentionally separate from #212, which adds the strict
govulncheckworkflow.Vulnerability result
The exact root scan (
govulncheck ./...) drops from 22 reachable findings to 5, removing all 17 findings with published runtime/module fixes.The remaining findings currently have no published fixed module release:
GO-2026-5932—golang.org/x/crypto/openpgpGO-2026-4740—github.com/shamaton/msgpack/v2GO-2026-4479—github.com/pion/dtls/v2GO-2025-3684—github.com/cosmos/evmGO-2024-2584—github.com/cosmos/cosmos-sdkNo finding is suppressed or silently baselined. The strict scan will continue to expose these five until separate upstream/backport/replacement work resolves them.
The nested
tests/systemtestsmodule reports two reachable residual IDs:GO-2026-5932andGO-2025-3684.State-machine and upgrade safety
Although this is dependency metadata only, it changes the compiled chain binary, so it was validated as a consensus-sensitive rollout candidate.
Validation
Passed locally with Go
1.26.6:go mod tidystabilitygo mod verify1045.845s)0 issues)git diff --checkFresh isolated runtime validation also passed:
ACTION_STATE_DONERisk
Primary risk is behavioral drift from the Go runtime and transitive dependency graph despite no Lumera source changes. The determinism, replay, EVM, system, simulation, and fresh distributed-runtime checks above are intended to bound that risk.
The five no-fixed-version findings remain explicit security debt and require separate remediation; this PR must not be described as producing a zero-finding scan.
Rollback
Before rollout, revert this commit to restore the previous Go/module graph. No state rollback or migration rollback is required because this PR introduces no state transformation.
If a rollout-only incompatibility appears, stop rollout and restore the prior binary using the existing rolling/canary procedure. Chain state remains compatible.
Observability
No logging, metric, event, or alert behavior is intentionally changed. Existing consensus, transaction, Supernode, and Cascade signals were used for validation.