run-llama / llama-agents / 42178163298
85%

DEFAULT BRANCH: main
Ran
Jobs 12
Files 235
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 85.146% (-0.03%) from 85.173%
42178163298

push

github

web-flow 
Update module golang.org/x/net to v0.62.0 [SECURITY] (#875)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.58.0` →
`v0.62.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.58.0...refs/tags/v0.62.0)
|
![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.62.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.58.0/v0.62.0?slim=true)
|

---

### HTTP/2 server memory exhaustion due to Trailer headers in net/http
BIT-golang-2026-78659 /
[CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) /
[GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603)

<details>
<summary>More information</summary>

#### Details
When "Trailer" headers are sent by a client, the HTTP server internally
uses the header values to populate the Request.Trailer map passed to the
server handler. Because Request.Trailer is a map, each entry incurs
memory overhead. For HTTP/2 servers, a malicious client can exploit this
by sending a "Trailer" header that declares a large number of fields,
causing the server to allocate a disproportionate amount of memory while
bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits.
This exploit is not applicable for HTTP/1 servers, which do not support
multiplexing a large number of requests over one TCP connection, and
whose Server.MaxHeaderBytes are calculated differently.

#### Severity
Unknown

#### References
- [https://go.dev/cl/847185](https://go.dev/cl/847185)
- [https://go.dev/cl/847314](https://go.dev/cl/847314)
- [https://go.dev/issue/81857](https://go.dev/issue/81857)
-
[https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI)
-
[https://groups.google.com/g/golan... (continued)

18956 of 22263 relevant lines covered (85.15%)

1.15 hits per line

Coverage Regressions

Lines Coverage ∆ File
5
85.52
-3.45% packages/llama-agents-appserver/src/llama_agents/appserver/routers/ui_proxy.py
1
71.88
-3.13% packages/llama-agents-appserver/src/llama_agents/appserver/interrupts.py
Jobs
ID Job ID Ran Files Coverage
1 llama-agents-agentcore - 42178163298.1 5
70.22
GitHub Action Run
2 llama-agents-client - 42178163298.2 4
95.32
GitHub Action Run
3 llama-agents-integration-tests - 42178163298.3 102
64.92
GitHub Action Run
4 llama-agents-dev - 42178163298.4 12
76.5
GitHub Action Run
5 llamactl - 42178163298.5 48
79.79
GitHub Action Run
6 llama-agents-dbos - 42178163298.6 11
75.72
GitHub Action Run
7 llama-index-workflows - 42178163298.7 53
94.18
GitHub Action Run
8 llama-agents-server - 42178163298.8 31
86.15
GitHub Action Run
9 llama-agents-appserver - 42178163298.9 17
81.53
GitHub Action Run
10 llama-index-utils-workflow - 42178163298.10 1
70.84
GitHub Action Run
11 llama-agents-control-plane - 42178163298.11 31
74.57
GitHub Action Run
12 llama-agents-core - 42178163298.12 15
81.34
GitHub Action Run
Source Files on build 42178163298