Repository navigation
fix: patch HTTP/2 dependencies and cover transport regressions - #3
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The plugin pins
golang.org/x/net0.58.0, which is affected by the October HTTP/2 security advisories. Update it to 0.60.0 with the required x/mod, x/sync, x/sys and x/text versions, and document the patched Go toolchain needed when rebuilding deployed binaries. The plugin SDK, production Go source and configuration contract remain unchanged.Cover authenticated GET and JSON POST requests over TLS/HTTP/2, response decoding, and conflicting Content-Length response headers. The malformed-header regression fails against the previous dependency with
-tags=http2legacyand passes after the update. Test both transport implementations because Go 1.27 uses the standard-library HTTP/2 transport by default.Add a plugin integration test that initializes the production plugin and runs
SyncAllagainst a local HTTP server. It checks all five tables, lookup by IP and ASN, JSON user-agent requests, optional modules, array flattening, NULLs for unrequested fields, table filtering, caller-IP lookup, migration messages, CloudQuery IDs and emitted Arrow rows. The same integration test also passes against the original dependency set.Add Linux CI on Go 1.26.10 and 1.27.3, with both race-enabled test modes, module verification, vet, a static Linux build and pinned govulncheck. Workflow actions are pinned to verified commit hashes and the workflow only needs read access.
Validation:
go vet ./...andgo mod verifypass;govulncheck ./...reports no reachable-vulnerability findings.842cd2f: both Go 1.26.10 and 1.27.3 jobs pass, including both race-enabled test modes, module verification, vet, static builds and govulncheck (no reachable-vulnerability findings).Tests use local HTTP servers and need no API key. A live authenticated API sync, external CloudQuery CLI/destination and deployed binaries were not tested; deployed binaries still need to be rebuilt after merging. This change publishes no releases or images.
Advisories: GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617.