From 9909e2dabbaeb940d8411806572f9a7dba0110ac Mon Sep 17 00:00:00 2001 From: Sebastien Tardif Date: Mon, 17 Aug 2026 21:04:31 -0700 Subject: [PATCH] chore(tui): bump golang.org/x/text to v0.41.0 CVE-2026-56852 (GO-2026-5970) is a DoS in unicode/norm on invalid UTF-8. The TUI pulled v0.3.8 transitively via bubbletea and go-localereader. The advisory is fixed in v0.39.0; pin the current v0.41.0. Keep the module go line at 1.24.0 so release CI (go-version 1.24.x) still builds. go1.24.11 go build and go test -race ./... both pass. Verified: make tui-lint tui-build; go test -race ./... under GOTOOLCHAIN=go1.24.11 Signed-off-by: Sebastien Tardif --- strix/interface/tui/go.mod | 2 +- strix/interface/tui/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/strix/interface/tui/go.mod b/strix/interface/tui/go.mod index 1ff6ec35..6e00a48f 100644 --- a/strix/interface/tui/go.mod +++ b/strix/interface/tui/go.mod @@ -28,5 +28,5 @@ require ( github.com/muesli/cancelreader v0.2.2 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect - golang.org/x/text v0.3.8 // indirect + golang.org/x/text v0.41.0 // indirect ) diff --git a/strix/interface/tui/go.sum b/strix/interface/tui/go.sum index f255aec1..4135a2db 100644 --- a/strix/interface/tui/go.sum +++ b/strix/interface/tui/go.sum @@ -57,5 +57,5 @@ golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/text v0.3.8 h1:nAL+RVCQ9uMn3vJZbV+MRnydTJFPf8qqY42YiA6MrqY= -golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=