Skip to content

deps: bump golang.org/x/image from 0.38.0 to 0.41.0 - #380

Merged
EricAndrechek merged 1 commit into
mainfrom
dependabot/go_modules/golang.org/x/image-0.41.0
Aug 10, 2026
Merged

deps: bump golang.org/x/image from 0.38.0 to 0.41.0#380
EricAndrechek merged 1 commit into
mainfrom
dependabot/go_modules/golang.org/x/image-0.41.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 7, 2026

Copy link
Copy Markdown
Contributor

Bumps golang.org/x/image from 0.38.0 to 0.41.0.

Commits
  • 0d61147 bmp: reject input with invalid palette index
  • fe8ae45 tiff: limit PackBits decompression output size
  • 542a3d9 go.mod: update golang.org/x dependencies
  • 5cbe89a tiff: reject 0-size images
  • 3d5c9b6 go.mod: update golang.org/x dependencies
  • 854c274 font/sfnt: apply bounds checks before allocating read buffer
  • 96edba0 webp: reject VP8X headers with too-large canvases
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 7, 2026
@dependabot
dependabot Bot requested review from a team and EricAndrechek July 7, 2026 15:39
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 7, 2026
@dependabot dependabot Bot added the go Pull requests that update go code label Jul 7, 2026
@github-actions github-actions Bot added area/infra CI, build, deploy, Docker, release and removed go Pull requests that update go code labels Jul 7, 2026
@github-code-quality

github-code-quality Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: Go

Go

The overall coverage in commit 203d35a in the dependabot/go_module... branch remains at 90%, unchanged from commit 4f599bd in the main branch.


Updated August 10, 2026 19:10 UTC

@EricAndrechek

Copy link
Copy Markdown
Member

@dependabot recreate

Rebase hit conflicts in go.mod/go.sum against the go-deps group bump that just landed in #438 (4f599bd). Regenerating from current main is cleaner than hand-resolving.

Still needed after #438: that PR did not touch golang.org/x/image (it stays at 0.38.0), so this remains the fix for GHSA-q675-qj96-32m9 (high).

Bumps [golang.org/x/image](https://github.com/golang/image) from 0.38.0 to 0.41.0.
- [Commits](golang/image@v0.38.0...v0.41.0)

---
updated-dependencies:
- dependency-name: golang.org/x/image
  dependency-version: 0.41.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/golang.org/x/image-0.41.0 branch from 633c465 to 203d35a Compare August 10, 2026 19:06
@EricAndrechek
EricAndrechek merged commit 3c7d62b into main Aug 10, 2026
15 checks passed
@EricAndrechek
EricAndrechek deleted the dependabot/go_modules/golang.org/x/image-0.41.0 branch August 10, 2026 19:21
@github-project-automation github-project-automation Bot moved this from Ready to Done in WaveHouse Task Board Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/infra CI, build, deploy, Docker, release dependencies Pull requests that update a dependency file

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

1 participant