From f388d79de9c304dd6a22a0332e764155eeed8287 Mon Sep 17 00:00:00 2001 From: Brendan Kellam Date: Mon, 3 Aug 2026 17:57:21 -0700 Subject: [PATCH 1/3] chore: bump zoekt submodule for CVE-2026-56852 Advance vendor/zoekt to include golang.org/x/text v0.39.0, which fixes the norm.Iter infinite loop on invalid UTF-8 input.\n\nResolves SOU-1751. --- vendor/zoekt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vendor/zoekt b/vendor/zoekt index 0e0e62bec..05e6c4099 160000 --- a/vendor/zoekt +++ b/vendor/zoekt @@ -1 +1 @@ -Subproject commit 0e0e62beca48b1444ed8fb11e742fd4010d57fb7 +Subproject commit 05e6c4099ecaab884b66a21c97e419bd11f507a8 From 959f6572b409d95cbef2a0a045c5b69eb9ca0991 Mon Sep 17 00:00:00 2001 From: Brendan Kellam Date: Mon, 3 Aug 2026 17:57:56 -0700 Subject: [PATCH 2/3] chore: update changelog for #1535 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d487b5b8c..32bafb26b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Upgraded `brace-expansion` to `^1.1.17`/`^2.1.3`/`^5.0.8`. [#1527](https://github.com/sourcebot-dev/sourcebot/pull/1527) +- Upgraded the bundled Zoekt `golang.org/x/text` dependency to `v0.39.0`. [#1535](https://github.com/sourcebot-dev/sourcebot/pull/1535) ## [5.1.5] - 2026-07-31 From e090f258e4762b81c2b08a49aef3e86b5d1cf67f Mon Sep 17 00:00:00 2001 From: Brendan Kellam Date: Mon, 3 Aug 2026 18:08:57 -0700 Subject: [PATCH 3/3] chore: remove changelog entry for #1535 --- CHANGELOG.md | 1 - 1 file changed, 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 32bafb26b..d487b5b8c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Upgraded `brace-expansion` to `^1.1.17`/`^2.1.3`/`^5.0.8`. [#1527](https://github.com/sourcebot-dev/sourcebot/pull/1527) -- Upgraded the bundled Zoekt `golang.org/x/text` dependency to `v0.39.0`. [#1535](https://github.com/sourcebot-dev/sourcebot/pull/1535) ## [5.1.5] - 2026-07-31