diff --git a/FIDELITY.md b/FIDELITY.md index 8bbc4fa..510f0c7 100644 --- a/FIDELITY.md +++ b/FIDELITY.md @@ -18,6 +18,15 @@ The committed PNGs under `testdata/renders/` back every claim here. Reproduce them with the commands at the bottom. The measured-vs-Chrome numbers live in [`bench/REPORT.md`](bench/REPORT.md). +## 2026-10-11 (round 169) — go.mod's own declared Go version had drifted behind CI's, making `govulncheck` report 8 already-patched stdlib vulnerabilities as live; `golang.org/x/net` bumped too (security audit, patch) + +A concurrent session's PR #270 moved CI's `GO_VERSION` from 1.27.1 to 1.27.2 (a security release, 13 stdlib advisories) but — correctly, since a `go` directive is a floor, not a pin — left `go.mod`'s own `go 1.27.1` line untouched. Re-reading this session's own notes per the standing "relis tes notes" instruction, then re-running `govulncheck` to confirm the new CI pin actually closed something, surfaced a real gap: `govulncheck ./...` reported 8 reachable stdlib vulnerabilities (GO-2026-6605, -6603, -6607, -6608, and others) "Found in: net/http@go1.27.1, Fixed in: go1.27.2" — even though the installed toolchain is 1.27.2. `govulncheck -version` showed why: it had resolved its own subprocess `go` to literally **1.27.1**, not the 1.27.2 my interactive shell's `go version` reported — a live, concrete instance of the exact trap an earlier round's own memory note already names ("Go's `stable` tag can silently point at a different minor than you think — measure with the CI's own toolchain, not an assumption"), except here the drift was go.mod's own stale `go` directive feeding govulncheck's stdlib-vulnerability baseline, not a `stable`-tag alias. + +- **Fixed**: `go.mod`'s `go 1.27.1` → `go 1.27.2`, matching CI's own pin — Go's toolchain management already auto-selects whatever satisfies the directive, so this changes nothing about what actually gets built; it only corrects what `govulncheck` (and any other tool reading the directive) believes the floor is. Re-ran `govulncheck ./...`: 0 reachable vulnerabilities, down from 8. +- **Also bumped while auditing**: `golang.org/x/net` v0.59.0 → v0.61.0 (`go get` + `go mod tidy`), closing 5 further advisories (GO-2026-6617/6612/6611/6610/6603, all HTTP/2 **server**-side — this engine is a client, so `govulncheck` already confirmed none were reachable either way; bumped anyway as cheap defense-in-depth rather than leaving a known-vulnerable version pinned for no reason). Pulled `golang.org/x/crypto` v0.57.0→v0.58.0, `x/sys` v0.48.0→v0.49.0, `x/text` v0.42.0→v0.43.0 along as transitive deps of the same `go mod tidy`. +- **Re-confirmed, not re-litigated**: `golang.org/x/crypto`'s `openpgp` package (GO-2026-5932, round 162's own finding) remains the one advisory `govulncheck` still lists as present-but-unreachable — the package is unmaintained by design with no fix version to bump to, not something this bump could close, and still isn't called by this engine's own code. Consistent with round 162; no new action. +- `go build ./...` and `go test ./...` both green on the bumped dependencies; no behaviour or API change, so this is a patch. + ## 2026-10-10 (round 168) — the 500-page bench corpus completed a full run for the first time (both crash fixes held); one real performance bug found and fixed along the way: font-face fallback candidates in one slot were tried one at a time, not concurrently (engine#267, patch) The 500-page run relaunched at the end of round 167 (both crash fixes in place) ran to completion: 500/500 pages, `wrote results-500.json and REPORT-500.md`, no crash — the first time this corpus has ever finished. Of the 96 pages marked "failed", 95 failed for BOTH webengine and Chrome (dead URLs, DNS, timeouts — confirmed via each entry's own `note` field) and exactly 1 was a transient DNS flake on this machine; zero are engine bugs. Ten-odd pages (`azure.microsoft.com`, `www.cs.cmu.edu`, `www.cia.gov`, `aws.amazon.com`, the `gitlab.com`/`about.gitlab.com` family, `foundation.zurb.com`, `www.lemonde.fr`) rendered 10-20× slower than Chrome (20-45s vs 1.5-5s), which is not a crash but is squarely what "mesure... améliore les performances" asks for. diff --git a/go.mod b/go.mod index c727927..be2fe81 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/go-webengine/engine -go 1.27.1 +go 1.27.2 require ( github.com/dop251/goja v0.0.0-20260926152631-39ec2650adc9 @@ -15,7 +15,7 @@ require ( github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef golang.org/x/image v0.46.0 - golang.org/x/net v0.59.0 + golang.org/x/net v0.61.0 ) require ( @@ -34,7 +34,7 @@ require ( github.com/sergeymakinen/go-bmp v1.0.0 // indirect github.com/sergeymakinen/go-ico v1.0.0 // indirect github.com/tannevaled/gobig2 v0.2.0 // indirect - golang.org/x/crypto v0.57.0 // indirect - golang.org/x/sys v0.48.0 // indirect - golang.org/x/text v0.42.0 // indirect + golang.org/x/crypto v0.58.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/text v0.43.0 // indirect ) diff --git a/go.sum b/go.sum index 51ae9ae..6f3d481 100644 --- a/go.sum +++ b/go.sum @@ -56,14 +56,14 @@ github.com/tannevaled/gobig2 v0.2.0 h1:yx97/ltljALrIWDFVqHjPUIjAp3bfUUhH8Z8UROvN github.com/tannevaled/gobig2 v0.2.0/go.mod h1:X0S1H+N35kg6zYgVYRqGMsGj3C35zs+iA2r1MXyPcV4= github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU= github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E= -golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= -golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= +golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ= golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= +golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= -golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= -golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=