From 12530e2ed3238e5d5e1d37953b902651b22da07c Mon Sep 17 00:00:00 2001 From: Tom Maiaroto Date: Thu, 8 Oct 2026 18:40:17 -0700 Subject: [PATCH 1/4] fix: upgrade deps to resolve open code scanning alerts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit excelize pseudo-version covers the agile-decryption DoS and sibling advisories; x/net v0.60.0 and the go 1.27.2 directive cover the October Go security release findings in net/http, crypto/tls, html/template, and os. ஃ Generated with Phosphor Assisted-by: Phosphor:CYBER-FROST-3.8-EXL3-SAGE-3.87bpw --- go.mod | 6 +++--- go.sum | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/go.mod b/go.mod index a2ab75b..51f3726 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/hackafterdark/phosphor -go 1.27.0 +go 1.27.2 require ( charm.land/bubbles/v2 v2.2.1 @@ -72,7 +72,7 @@ require ( github.com/tidwall/sjson v1.2.5 github.com/tree-sitter/go-tree-sitter v0.25.0 github.com/tsawler/prose/v3 v3.0.0-beta2 - github.com/xuri/excelize/v2 v2.11.0 + github.com/xuri/excelize/v2 v2.11.1-0.20260906004932-2badfcd5841d github.com/zeebo/xxh3 v1.1.0 github.com/zricethezav/gitleaks/v8 v8.30.1 go.opentelemetry.io/otel v1.46.0 @@ -85,7 +85,7 @@ require ( go.uber.org/goleak v1.3.0 golang.design/x/clipboard v0.9.0 golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba - golang.org/x/net v0.59.0 + golang.org/x/net v0.60.0 golang.org/x/sync v0.23.0 golang.org/x/sys v0.48.0 golang.org/x/text v0.42.0 diff --git a/go.sum b/go.sum index 09b6ca0..467fc54 100644 --- a/go.sum +++ b/go.sum @@ -568,8 +568,8 @@ github.com/xo/terminfo v1.2.0 h1:d0ZTOCpuGE0lwSAOs0zcJjwz3jWQyqcRt9XbGJpCOl4= github.com/xo/terminfo v1.2.0/go.mod h1:lGzkSo8Fe7IRh/w+Gqz7n5mDog4FVXCj3gy/DYTBqio= github.com/xuri/efp v0.0.2 h1:74yhBh0nfIWLOrN76wtShYVse94pADGYS0/c86jOp8Q= github.com/xuri/efp v0.0.2/go.mod h1:ybY/Jr0T0GTCnYjKqmdwxyxn2BQf2RcQIIvex5QldPI= -github.com/xuri/excelize/v2 v2.11.0 h1:HxaEFl6sRN2+8J5a8HaKq+0M4FsjBGMnWWtjOCPSG88= -github.com/xuri/excelize/v2 v2.11.0/go.mod h1:jxFLbzaIwGQ5ufFNvYfUOHqXhfPaNmP14KWfmNz2Uak= +github.com/xuri/excelize/v2 v2.11.1-0.20260906004932-2badfcd5841d h1:L8Dz2FlwCYDLjw/xlxynaG5gwTid8eLoFm7a7MGhqkA= +github.com/xuri/excelize/v2 v2.11.1-0.20260906004932-2badfcd5841d/go.mod h1:WnwweQUkWv/3Y6OBVy0bgqN0zHAbn2N+i2zPUAXF1SI= github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9 h1:+C0TIdyyYmzadGaL/HBLbf3WdLgC29pgyhTjAT/0nuE= github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9/go.mod h1:WwHg+CVyzlv/TX9xqBFXEZAuxOPxn2k1GNHwG41IIUQ= github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU= @@ -656,8 +656,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= From 223c4f9de4feeb5f2824f9cac913627ab22fdeba Mon Sep 17 00:00:00 2001 From: Tom Maiaroto Date: Thu, 8 Oct 2026 18:45:09 -0700 Subject: [PATCH 2/4] ci: pin govulncheck runner to the go.mod toolchain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The default stable resolver lagged behind the patched stdlib release, so security scans kept reporting fixed vulnerabilities. ஃ Generated with Phosphor Assisted-by: Phosphor:CYBER-FROST-3.8-EXL3-SAGE-3.87bpw --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index f14df8b..75f3d2b 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -67,7 +67,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: stable + go-version-file: go.mod - name: Install govulncheck run: go install golang.org/x/vuln/cmd/govulncheck@latest - name: Run govulncheck From 74a81c446f0e4904029d0d87df9c34b2a4badca2 Mon Sep 17 00:00:00 2001 From: Tom Maiaroto Date: Thu, 8 Oct 2026 18:48:19 -0700 Subject: [PATCH 3/4] ci: run govulncheck on the patched toolchain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The stable resolver lags security releases, so scans reported stdlib vulnerabilities that the pinned 1.27.2 toolchain already fixes. The go directive stays at 1.27.0 to keep the shared CI runners usable. ஃ Generated with Phosphor Assisted-by: Phosphor:CYBER-FROST-3.8-EXL3-SAGE-3.87bpw --- .github/workflows/security.yml | 4 +++- go.mod | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 75f3d2b..96375a9 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -67,7 +67,9 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version-file: go.mod + # Pin the patched stdlib release so govulncheck reports against + # it; "stable" resolves from a mirror that lags security releases. + go-version: 1.27.2 - name: Install govulncheck run: go install golang.org/x/vuln/cmd/govulncheck@latest - name: Run govulncheck diff --git a/go.mod b/go.mod index 51f3726..f0f64f5 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/hackafterdark/phosphor -go 1.27.2 +go 1.27.0 require ( charm.land/bubbles/v2 v2.2.1 From 171baeeae595d5d0f3bc0b81f344f805f37f9ea7 Mon Sep 17 00:00:00 2001 From: Tom Maiaroto Date: Thu, 8 Oct 2026 19:16:42 -0700 Subject: [PATCH 4/4] fix: raise excelize to a revision covering all open advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The workspace indexer feeds untrusted workbook bytes to excelize, so pin the newest upstream revision that includes the remaining DoS and panic fixes rather than only the spin-count one. ஃ Generated with Phosphor Assisted-by: Phosphor:CYBER-FROST-3.8-EXL3-SAGE-3.87bpw --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index f0f64f5..1fb8120 100644 --- a/go.mod +++ b/go.mod @@ -72,7 +72,7 @@ require ( github.com/tidwall/sjson v1.2.5 github.com/tree-sitter/go-tree-sitter v0.25.0 github.com/tsawler/prose/v3 v3.0.0-beta2 - github.com/xuri/excelize/v2 v2.11.1-0.20260906004932-2badfcd5841d + github.com/xuri/excelize/v2 v2.11.1-0.20261008044812-1cf5392f4fb7 github.com/zeebo/xxh3 v1.1.0 github.com/zricethezav/gitleaks/v8 v8.30.1 go.opentelemetry.io/otel v1.46.0 diff --git a/go.sum b/go.sum index 467fc54..52fd875 100644 --- a/go.sum +++ b/go.sum @@ -568,8 +568,8 @@ github.com/xo/terminfo v1.2.0 h1:d0ZTOCpuGE0lwSAOs0zcJjwz3jWQyqcRt9XbGJpCOl4= github.com/xo/terminfo v1.2.0/go.mod h1:lGzkSo8Fe7IRh/w+Gqz7n5mDog4FVXCj3gy/DYTBqio= github.com/xuri/efp v0.0.2 h1:74yhBh0nfIWLOrN76wtShYVse94pADGYS0/c86jOp8Q= github.com/xuri/efp v0.0.2/go.mod h1:ybY/Jr0T0GTCnYjKqmdwxyxn2BQf2RcQIIvex5QldPI= -github.com/xuri/excelize/v2 v2.11.1-0.20260906004932-2badfcd5841d h1:L8Dz2FlwCYDLjw/xlxynaG5gwTid8eLoFm7a7MGhqkA= -github.com/xuri/excelize/v2 v2.11.1-0.20260906004932-2badfcd5841d/go.mod h1:WnwweQUkWv/3Y6OBVy0bgqN0zHAbn2N+i2zPUAXF1SI= +github.com/xuri/excelize/v2 v2.11.1-0.20261008044812-1cf5392f4fb7 h1:P6x9pUrn51xZvzmGVgrIXIppemaGWQBAfglvUjqMo+c= +github.com/xuri/excelize/v2 v2.11.1-0.20261008044812-1cf5392f4fb7/go.mod h1:d2KG/tW81cIhSeC3S7wENv3qRnOC3MDcrjDicKuZa6U= github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9 h1:+C0TIdyyYmzadGaL/HBLbf3WdLgC29pgyhTjAT/0nuE= github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9/go.mod h1:WwHg+CVyzlv/TX9xqBFXEZAuxOPxn2k1GNHwG41IIUQ= github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=