can you take a look at https://github.com/entireio/git-sync/security/dependabot/5
can you take a look at https://github.com/entireio/git-sync/security/dependabot/5
Done. Here's the outcome:
Fixed alert #5 by bumping golang.org/x/net v0.54.0 → v0.55.0 (which also pulled x/sys v0.44.0 → v0.45.0). Build passes.
Changes are staged in the working tree only (go.mod + go.sum) — I haven't committed. Note we're currently on branch soph/enable-ref-backend.
Want me to:
- Commit this on the current branch, or a fresh branch (e.g.
soph/bump-x-net)? - Open a PR?
Also worth knowing: since x/net is only a transitive dep and we don't touch x/net/html, there was no real exposure — this bump just clears the Dependabot alert cleanly.
do a frech branch but base it of this branch
Done. Created branch soph/bump-x-net off soph/enable-ref-backend and committed the bump (770216b1).
Want me to push it and open a PR? If so, against which base — soph/enable-ref-backend or main?