Skip to content

build: align go.mod's own Go version with CI's pin; bump golang.org/x/net #271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tannevaled merged 1 commit into from
Oct 11, 2026
Merged

build: align go.mod's own Go version with CI's pin; bump golang.org/x/net #271

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions FIDELITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,15 @@ The committed PNGs under `testdata/renders/` back every claim here. Reproduce
them with the commands at the bottom. The measured-vs-Chrome numbers live in
[`bench/REPORT.md`](bench/REPORT.md).

## 2026-10-11 (round 169) — go.mod's own declared Go version had drifted behind CI's, making `govulncheck` report 8 already-patched stdlib vulnerabilities as live; `golang.org/x/net` bumped too (security audit, patch)

A concurrent session's PR #270 moved CI's `GO_VERSION` from 1.27.1 to 1.27.2 (a security release, 13 stdlib advisories) but — correctly, since a `go` directive is a floor, not a pin — left `go.mod`'s own `go 1.27.1` line untouched. Re-reading this session's own notes per the standing "relis tes notes" instruction, then re-running `govulncheck` to confirm the new CI pin actually closed something, surfaced a real gap: `govulncheck ./...` reported 8 reachable stdlib vulnerabilities (GO-2026-6605, -6603, -6607, -6608, and others) "Found in: net/http@go1.27.1, Fixed in: go1.27.2" — even though the installed toolchain is 1.27.2. `govulncheck -version` showed why: it had resolved its own subprocess `go` to literally **1.27.1**, not the 1.27.2 my interactive shell's `go version` reported — a live, concrete instance of the exact trap an earlier round's own memory note already names ("Go's `stable` tag can silently point at a different minor than you think — measure with the CI's own toolchain, not an assumption"), except here the drift was go.mod's own stale `go` directive feeding govulncheck's stdlib-vulnerability baseline, not a `stable`-tag alias.

- **Fixed**: `go.mod`'s `go 1.27.1` → `go 1.27.2`, matching CI's own pin — Go's toolchain management already auto-selects whatever satisfies the directive, so this changes nothing about what actually gets built; it only corrects what `govulncheck` (and any other tool reading the directive) believes the floor is. Re-ran `govulncheck ./...`: 0 reachable vulnerabilities, down from 8.
- **Also bumped while auditing**: `golang.org/x/net` v0.59.0 → v0.61.0 (`go get` + `go mod tidy`), closing 5 further advisories (GO-2026-6617/6612/6611/6610/6603, all HTTP/2 **server**-side — this engine is a client, so `govulncheck` already confirmed none were reachable either way; bumped anyway as cheap defense-in-depth rather than leaving a known-vulnerable version pinned for no reason). Pulled `golang.org/x/crypto` v0.57.0→v0.58.0, `x/sys` v0.48.0→v0.49.0, `x/text` v0.42.0→v0.43.0 along as transitive deps of the same `go mod tidy`.
- **Re-confirmed, not re-litigated**: `golang.org/x/crypto`'s `openpgp` package (GO-2026-5932, round 162's own finding) remains the one advisory `govulncheck` still lists as present-but-unreachable — the package is unmaintained by design with no fix version to bump to, not something this bump could close, and still isn't called by this engine's own code. Consistent with round 162; no new action.
- `go build ./...` and `go test ./...` both green on the bumped dependencies; no behaviour or API change, so this is a patch.

## 2026-10-10 (round 168) — the 500-page bench corpus completed a full run for the first time (both crash fixes held); one real performance bug found and fixed along the way: font-face fallback candidates in one slot were tried one at a time, not concurrently (engine#267, patch)

The 500-page run relaunched at the end of round 167 (both crash fixes in place) ran to completion: 500/500 pages, `wrote results-500.json and REPORT-500.md`, no crash — the first time this corpus has ever finished. Of the 96 pages marked "failed", 95 failed for BOTH webengine and Chrome (dead URLs, DNS, timeouts — confirmed via each entry's own `note` field) and exactly 1 was a transient DNS flake on this machine; zero are engine bugs. Ten-odd pages (`azure.microsoft.com`, `www.cs.cmu.edu`, `www.cia.gov`, `aws.amazon.com`, the `gitlab.com`/`about.gitlab.com` family, `foundation.zurb.com`, `www.lemonde.fr`) rendered 10-20× slower than Chrome (20-45s vs 1.5-5s), which is not a crash but is squarely what "mesure... améliore les performances" asks for.
Expand Down
10 changes: 5 additions & 5 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/go-webengine/engine

go 1.27.1
go 1.27.2

require (
github.com/dop251/goja v0.0.0-20260926152631-39ec2650adc9
Expand All @@ -15,7 +15,7 @@ require (
github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c
github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef
golang.org/x/image v0.46.0
golang.org/x/net v0.59.0
golang.org/x/net v0.61.0
)

require (
Expand All @@ -34,7 +34,7 @@ require (
github.com/sergeymakinen/go-bmp v1.0.0 // indirect
github.com/sergeymakinen/go-ico v1.0.0 // indirect
github.com/tannevaled/gobig2 v0.2.0 // indirect
golang.org/x/crypto v0.57.0 // indirect
golang.org/x/sys v0.48.0 // indirect
golang.org/x/text v0.42.0 // indirect
golang.org/x/crypto v0.58.0 // indirect
golang.org/x/sys v0.49.0 // indirect
golang.org/x/text v0.43.0 // indirect
)
16 changes: 8 additions & 8 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,14 +56,14 @@ github.com/tannevaled/gobig2 v0.2.0 h1:yx97/ltljALrIWDFVqHjPUIjAp3bfUUhH8Z8UROvN
github.com/tannevaled/gobig2 v0.2.0/go.mod h1:X0S1H+N35kg6zYgVYRqGMsGj3C35zs+iA2r1MXyPcV4=
github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ=
golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew=
golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
Loading