codenotary / immudb / 28174993991
85%
master: 85%

LAST BUILD BRANCH: fix/pgsql-empty-parse-panic
DEFAULT BRANCH: master
Ran
Jobs 1
Files 311
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 84.981% (+0.02%) from 84.96%
28174993991

Pull #2102

gh-ci

vchaindz 
chore(deps): bump golang.org/x/{crypto,net,sys} to clear Trivy CVEs

A Trivy repository scan flagged three golang.org/x packages, each one
minor line behind its fixed version, as the source of all HIGH/MEDIUM
Go-dependency findings in the shipped product:

  golang.org/x/crypto v0.48.0 -> v0.52.0  (8 HIGH + 5 MEDIUM CVEs)
  golang.org/x/net    v0.50.0 -> v0.55.0  (7 HIGH + 1 MEDIUM CVEs)
  golang.org/x/sys    v0.41.0 -> v0.45.0  (CVE-2026-39824; v0.45.0 is
                                           required transitively by the
                                           crypto/net bumps)

Applied across all real modules: root, test/columns, test/e2e/truncation,
tools/mkdb, and the two test/document_storage_tests modules, with matching
transitive x/{sync,mod,term,text,tools} updates and a go 1.24 -> 1.25
directive alignment (x/net v0.55.0 requires go 1.25; the root module was
already on 1.25.0).

After the bump all real modules report 0 vulnerabilities. The single
CRITICAL in the scan (google.golang.org/grpc v1.58.3, CVE-2026-33186) is
intentionally left as-is: it exists only in the deliberately-frozen
docs/security/vulnerabilities/linear-fake fixtures, which are not part of
the shipped product (the product already uses grpc v1.79.3).

No source changes; go build, go vet, go mod verify and the embedded/sql +
pkg/database test suites all pass.
Pull Request #2102: chore(deps): bump golang.org/x/{crypto,net,sys} to clear Trivy CVEs

45219 of 53211 relevant lines covered (84.98%)

125924.3 hits per line

Jobs
ID Job ID Ran Files Coverage
1 28174993991.1 311
84.98
Source Files on build 28174993991