36833275969
26%

Ran 01 Oct 2026 08:01AM UTC

Jobs 1

Files 20

Run time 1min

Badge

Embed ▾

Committed 01 Oct 2026 07:56AM UTC coverage: 25.576%. Remained the same

Build # 36833275969

Build Type

push

github

Committed by

web-flow

Commit Message

sec: bump golang.org/x dependencies to address security CVEs (#619)

## Summary

- Bumps `golang.org/x/crypto` from v0.54.0 → v0.57.0 to address
**CVE-2026-56855** (due 2026-12-04)
- Bumps `golang.org/x/net` from v0.57.0 → v0.59.0
- Bumps transitive siblings `x/mod`, `x/sync`, `x/sys`, `x/term`,
`x/text`, `x/tools` to their latest versions

These fixes address findings reported in the security scan report for
`compass-manager` (issues #12022, #12914).

## What was NOT fixed (and why)

| Package | CVE | Reason |
|---|---|---|
| `golang-runtime` | CVE-2026-56858, CVE-2026-39821, others | Go 1.27.1
is the latest stable release; a future patch (1.27.2+) is needed. Update
the `FROM golang:1.27.x` in `Dockerfile` once available. |
| `github.com/onrik/logrus` v0.11.0 | CVE-2025-65637 | v0.11.0 is the
latest release — no patched version exists upstream yet. Pulled in
transitively via
`github.com/kyma-incubator/compass/components/director`. |
| `github.com/go-openapi/swag` | CVE-2026-93450 | Already at v0.27.1 on
main — not affected. |

## Test plan

- [x] `go build ./...` passes
- [x] All passing tests remain passing (controllers suite failure is
pre-existing on main, unrelated to this change)

Coverage Stats

722 of 2823 relevant lines covered (25.58%)

0.26 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	36833275969.1	01 Oct 2026 08:01AM UTC	20	25.58	GitHub Action Run

kyma-project / compass-manager / 36833275969
26%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 36833275969

kyma-project / compass-manager / 36833275969 26%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 36833275969

kyma-project / compass-manager / 36833275969
26%

README BADGES
x