chore(deps): bump github.com/go-resty/resty/v2 from 2.16.5 to 2.17.2#77
chore(deps): bump github.com/go-resty/resty/v2 from 2.16.5 to 2.17.2#77dependabot[bot] wants to merge 1 commit intomasterfrom
Conversation
Bumps [github.com/go-resty/resty/v2](https://github.com/go-resty/resty) from 2.16.5 to 2.17.2. - [Release notes](https://github.com/go-resty/resty/releases) - [Commits](go-resty/resty@v2.16.5...v2.17.2) --- updated-dependencies: - dependency-name: github.com/go-resty/resty/v2 dependency-version: 2.17.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
the
dependencies
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Note
|
| Cohort / File(s) | Summary |
|---|---|
Dependency Updates go.mod |
Updated go-resty/resty/v2 to v2.17.2 and golang.org/x/net to v0.43.0; no breaking API or functional changes. |
Estimated code review effort
🎯 1 (Trivial) | ⏱️ ~2 minutes
🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
| Check name | Status | Explanation |
|---|---|---|
| Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | ✅ Passed | The title directly and specifically describes the main change: a dependency version bump of go-resty/resty/v2 from 2.16.5 to 2.17.2, which aligns with the changeset modifications. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
| Merge Conflict Detection | ✅ Passed | ✅ No merge conflicts detected when merging into master |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Post copyable unit tests in a comment
- Commit unit tests in branch
dependabot/go_modules/github.com/go-resty/resty/v2-2.17.2
Comment @coderabbitai help to get the list of available commands and usage tips.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@go.mod`:
- Line 8: Update the indirect dependency golang.org/x/net in go.mod from v0.43.0
to v0.45.0 or later (preferably v0.50.0) to remediate CVE-2025-47911; run `go
get golang.org/x/net@v0.50.0` (or `@v0.45.0+`) and then `go mod tidy` to update
the module requirements and lockfile so the project uses the patched html.Parse
implementation.
- Line 4: The go.mod currently pulls github.com/go-resty/resty/v2 which brings
an indirect golang.org/x/net at v0.43.0 that has DoS vulnerabilities; add an
explicit require in go.mod for golang.org/x/net at v0.45.0 or later to override
the transitive version, then refresh the module graph (update dependencies and
run module tidy) and verify the resolved version of golang.org/x/net is >=
v0.45.0 (check the module graph/list) so the vulnerable transitive version is no
longer used.
|
|
||
| require ( | ||
| github.com/go-resty/resty/v2 v2.16.5 | ||
| github.com/go-resty/resty/v2 v2.17.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
github.com/go-resty/resty/v2 v2.17.2 security advisories vulnerabilities
💡 Result:
For github.com/go-resty/resty/v2 v2.17.2, I only found one published direct security advisory for Resty:
- CVE-2023-45286 / GHSA-xwh9-gc39-5298: race condition that can disclose HTTP request bodies across requests (notably when retries occur). Affected versions:
>= 2.10.0and< 2.11.0(Snyk also notes>= 2.10.0-rc.1and< 2.11.0). Patched in:2.11.0.
Therefore, v2.17.2 is not in the affected range. [1][2][3]
Sources: [1] GHSA-xwh9-gc39-5298, [2] https://pkg.go.dev/vuln/GO-2023-2328, [3] https://security.snyk.io/package/golang/github.com%2Fgo-resty%2Fresty%2Fv2
🌐 Web query:
golang.org/x/net v0.43.0 security advisories vulnerabilities
💡 Result:
For golang.org/x/net v0.43.0, the Go vulnerability database reports these known vulnerabilities that still affect that version (i.e., fixed only in later releases):
- CVE-2025-58190 / GO-2026-4441 —
golang.org/x/net/htmlhtml.Parse*can enter an infinite parsing loop on certain inputs → DoS. Affected:< v0.45.0(so v0.43.0 is affected). Fix: upgrade to v0.45.0+. [1] - CVE-2025-47911 / GO-2026-4440 —
golang.org/x/net/htmlhtml.Parse*can have quadratic parsing complexity on certain inputs → DoS. Affected:< v0.45.0(so v0.43.0 is affected). Fix: upgrade to v0.45.0+. [2]
Notes (not affecting v0.43.0 because they were fixed earlier):
- CVE-2025-22872 / GO-2025-3595 affected
< v0.38.0. [3] - CVE-2024-45338 / GO-2024-3333 affected
< v0.33.0. [4]
Sources: [1] [2] [3] [4]
🌐 Web query:
go-resty/resty v2.17.2 release notes changelog
💡 Result:
go-resty/resty v2.17.2 — release notes / changelog
Release date: Feb 14, 2026. [1]
What changed
- Backport: “header deepcopy fix” — Resty now clones request headers when creating the underlying
http.Request(i.e.,r.RawRequest.Header = r.Header.Clone()), preventing unintended header sharing/mutation. [2] - Release maintenance: version bump to v2.17.2 and README update. [1]
Full changelog (compare)
v2.17.1...v2.17.2[1]
Sources: GitHub release v2.17.2 [1], PR #1110 diff (“header deepcopy fix”) [2].
Update golang.org/x/net to v0.45.0 or later to address critical DoS vulnerabilities.
While resty v2.17.2 is safe (released Feb 14, 2026 with header handling fixes and no active security advisories), the indirect dependency update to golang.org/x/net v0.43.0 introduces two known DoS vulnerabilities:
- CVE-2025-58190 / GO-2026-4441: infinite parsing loop in
html.Parse*functions - CVE-2025-47911 / GO-2026-4440: quadratic parsing complexity in
html.Parse*functions
Both vulnerabilities are fixed in golang.org/x/net v0.45.0 and later. Update the transitive dependency to v0.45.0+ to address these issues.
🤖 Prompt for AI Agents
In `@go.mod` at line 4, The go.mod currently pulls github.com/go-resty/resty/v2
which brings an indirect golang.org/x/net at v0.43.0 that has DoS
vulnerabilities; add an explicit require in go.mod for golang.org/x/net at
v0.45.0 or later to override the transitive version, then refresh the module
graph (update dependencies and run module tidy) and verify the resolved version
of golang.org/x/net is >= v0.45.0 (check the module graph/list) so the
vulnerable transitive version is no longer used.
| ) | ||
|
|
||
| require golang.org/x/net v0.39.0 // indirect | ||
| require golang.org/x/net v0.43.0 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if golang.org/x/net v0.43.0 exists and get version info
echo "Checking golang.org/x/net v0.43.0 on Go module proxy..."
curl -s "https://proxy.golang.org/golang.org/x/net/@v/v0.43.0.info" 2>&1 | head -50
echo -e "\n\n--- Checking recent versions ---"
curl -s "https://proxy.golang.org/golang.org/x/net/@latest" 2>&1 | head -20Repository: lokalise/go-lokalise-api
Length of output: 539
🌐 Web query:
golang.org/x/net v0.43.0 security vulnerabilities CVE
💡 Result:
golang.org/x/net v0.43.0 (released Aug 7, 2025) is affected by the following Go vulnerability/CVE:
- CVE-2025-47911 (Go vuln: GO-2026-4440) —
golang.org/x/net/htmlhtml.Parse(and related parse APIs) can exhibit quadratic parsing complexity, enabling DoS with crafted HTML input. Affected: before v0.45.0 → v0.43.0 is vulnerable. Fix: upgrade to v0.45.0+. [1][4]
Commonly-associated x/net CVEs that do not affect v0.43.0 (already fixed in earlier versions):
- CVE-2025-22872 (GO-2025-3595) — affected before v0.38.0 → v0.43.0 not affected. [2]
- CVE-2025-22870 (GO-2025-3503) — affected before v0.36.0 → v0.43.0 not affected. [3]
Upgrade golang.org/x/net to v0.45.0 or later to fix a DoS vulnerability.
golang.org/x/net v0.43.0 contains CVE-2025-47911 (GO-2026-4440), which causes quadratic parsing complexity in html.Parse, allowing denial-of-service attacks with crafted HTML input. Upgrade to v0.45.0 or later; v0.50.0 is the latest available version and recommended.
🤖 Prompt for AI Agents
In `@go.mod` at line 8, Update the indirect dependency golang.org/x/net in go.mod
from v0.43.0 to v0.45.0 or later (preferably v0.50.0) to remediate
CVE-2025-47911; run `go get golang.org/x/net@v0.50.0` (or `@v0.45.0+`) and then
`go mod tidy` to update the module requirements and lockfile so the project uses
the patched html.Parse implementation.
Bumps github.com/go-resty/resty/v2 from 2.16.5 to 2.17.2.
Release notes
Sourced from github.com/go-resty/resty/v2's releases.
Commits
b1b3aaarelease: version bump to v2.17.2 and readme update (#1112)fb4a091backport: header deepcopy fix (#1110)52f3f39Merge pull request #1079 from go-resty/fix-cnt-type-hdr-on-emptybody16e2701release: v2.17.1 readme update203bf14fix: content type request header on http.NoBody type #1074061e449chore: version bump to v2.17.1d4c3576Merge pull request #1066 from go-resty/for-v2.17.0-release6452271chore: update readme for release v2.17.02eab959ci: update go version 1.23.0795d6c2chore: update go.mod package versionsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit