security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-5cv4-jp36-h3mw	golang.org/x/net	None	v0.53.0	0.55.0		confirmed

Not Included

• Deferred by batch limit: 26 advisories. They will be considered by future runs.
• Other deferred scanner findings: 2.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	github.com/getkin/kin-openapi	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	golang.org/x/crypto	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Dependency-only security patch with no logic changes; risk is limited to transitive behavior in networking/crypto/stdlib-adjacent packages.

Overview
Security dependency bump with no application source changes—only go.mod and go.sum.

The direct fix is golang.org/x/net v0.53.0 → v0.55.0 for GHSA-5cv4-jp36-h3mw. The module is a direct dependency (used e.g. from ingress via golang.org/x/net/http/httpguts).

go mod also raised golang.org/x/sys (v0.43.0 → v0.45.0) and several indirect golang.org/x/* pins (crypto, mod, text, tools). go.sum was refreshed and now records many additional transitive checksums (including entries that look newly materialized after tidy), without changing first-party code.

^{Reviewed by Cursor Bugbot for commit b8a2b4d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​net@​v0.53.0 ⏵ v0.55.0		+2
	golang.org/​x/​sys@​v0.43.0 ⏵ v0.45.0

View full report