mirrors/remark42
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: bump golang.org/x/image to v0.45.0 for GO-2026-6222

Browse Source 
Excessive memory allocation during VP8L decoding, reachable from
app/store/image/image.go:333 where image.Decode runs on uploaded data.
The existing DecodeConfig dimension guard doesn't cover it, since the
over-allocation happens during decode rather than from declared dimensions.

Tidies backend/_example/memory_store in the same commit: it carries the
backend's deps as indirect entries and would otherwise fail the example CI step.
This commit is contained in:
Umputun
2026-08-18 20:24:30 -05:00
parent a725d990ed
commit 35a389cb75
44 changed files with 261 additions and 346 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/_example/memory_store/go.mod
+2 -2
View File
@@ -29,9 +29,9 @@ require (
github.com/russross/blackfriday/v2 v2.1.0 // indirect
go.etcd.io/bbolt v1.5.0 // indirect
golang.org/x/crypto v0.53.0 // indirect
golang.org/x/image v0.43.0 // indirect
golang.org/x/image v0.45.0 // indirect
golang.org/x/net v0.56.0 // indirect
golang.org/x/sys v0.46.0 // indirect
golang.org/x/sys v0.47.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)