bump httpx version #6425
bump httpx version #6425
Conversation
WalkthroughBumped dependency versions in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. 📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 💡 Knowledge Base configuration:
You can enable these sources in your CodeRabbit configuration. ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod(7 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Lint
🔇 Additional comments (5)
go.mod (5)
98-110: Action required: address build failure for missing regexes.json before verifying httpx bumpIt looks like the build is currently failing due to a missing
regexes.jsonfile, which prevents us from completing the upgrade validation:• Error:
pkg/output/stats/waf/waf.go:27:12: pattern regexes.json: no matching files found
– File referencing the resource:pkg/output/stats/waf/waf.go(around line 27)
– Please ensureregexes.jsonexists at the expected path or update the code to point to the correct location.Once the resource issue is resolved:
- Re-run the build and test suite to confirm that the bump to
github.com/projectdiscovery/httpx v1.7.1introduces no behavioral changes (timeouts, retry logic, TLS defaults, etc.).- Verify that the other dependency bumps in this PR are intentional and introduce no unintended side-effects.
Also, please update the PR title and description to reflect all dependency bumps included in this change set (e.g., httpx, mapcidr, networkpolicy, wappalyzergo, golang.org/x/*). This will aid future traceability.
342-345: No errgroup/semaphore/singleflight usage found; x/sync v0.16.0 upgrade is safeI searched the entire codebase for any imports or references to golang.org/x/sync’s errgroup, semaphore, and singleflight packages and found none. Therefore, upgrading to v0.16.0 has no impact on existing semantics.
No further action required.
119-122: golang.org/x/term v0.33.0 – cross-platform password input verificationBefore verifying x/term behavior, the code must build cleanly:
- Fix the embed error in pkg/output/stats/waf/waf.go (“pattern regexes.json: no matching files found”) so that go build succeeds.
Once the build is green, confirm there are no regressions in raw-mode password prompts:
term.ReadPassword is called in:
- pkg/templates/signer/handler.go:111
- pkg/templates/signer/handler.go:272
- pkg/templates/signer/handler.go:281
Manually test or run CI jobs on Windows, BSD, and macOS to ensure ReadPassword still behaves correctly (fd detection, escape handling, prompt visibility).
If you also rely on terminal GetSize or MakeRaw elsewhere, include those code paths in your cross-platform checks.
Ensure your CI matrix covers these platforms or document the manual verification steps.
40-43: golang.org/x/net and x/text patch bumps approved—no regressions detectedBuild succeeded and targeted tests for HTML parsing, HTTP/2, “Net” and “Text” areas completed without failures. The version bumps for x/net (v0.42.0) and x/text (v0.27.0) did not introduce any sanitizer or parser diffs in our test suite.
• Dependabot bumps in go.mod:
- golang.org/x/net v0.42.0
- golang.org/x/text v0.27.0
• Verified:
- HTTP/2 and HTML-related functionality
- “Net” proxy and publicsuffix behavior
- Text casing and language utilities
— LGTM; keep an eye on any downstream text/HTML parsing or HTTP tests in CI.
(Note: the test failure in pkg/output/stats/waf/waf.go—“pattern regexes.json: no matching files found”—appears unrelated to these bumps and should be addressed separately.)
297-299: No direct usage of cdncheck – indirect dependency updatego.mod shows cdncheck v1.1.27 as an indirect dependency, pulled in via
internal/runnerandhttpx(confirmed withgo mod why -m github.com/projectdiscovery/cdncheck). Searches for “cdncheck” in our code and tests returned no matches. Since we don’t import or exercise cdncheck directly (its heuristics run only inside HTTPX), this update won’t affect our code or test suite, and no changelog note is required.
go.mod
Outdated
| golang.org/x/crypto v0.40.0 // indirect | ||
| golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b | ||
| golang.org/x/mod v0.25.0 // indirect | ||
| golang.org/x/sys v0.33.0 // indirect | ||
| golang.org/x/sys v0.34.0 // indirect | ||
| golang.org/x/time v0.11.0 // indirect | ||
| golang.org/x/tools v0.34.0 |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
golang.org/x/crypto and x/sys bumps: good hardening; validate TLS and syscall-sensitive paths
These bumps often include security and platform fixes. Validate:
- TLS handshakes/fingerprints if you pin JA3/Hello variants.
- Any low-level syscall/code paths (file perms, socket options) on Linux/Windows/Darwin.
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -nP --type=go -C2 'golang\.org/x/crypto|crypto/tls|x/sys'
go build ./...
# Optional: quick TLS smoke via existing tests or a small probe if available.
go test ./... -run TLS|Crypto|Sys -count=1 || trueLength of output: 13859
Critical Build Failure – Missing regexes.json
The verification script could not complete because the build is broken due to a missing file reference:
• pkg/output/stats/waf/waf.go:27:12 – attempts to load regexes.json, but no matching file is present.
Please resolve this before proceeding:
- Add the
regexes.jsonfile at the expected path underpkg/output/stats/waf/, or update the code to reference the correct file/location. - Once the build succeeds, re-run the upgrade validation:
rg -nP --type=go -C2 'golang\.org/x/crypto|crypto/tls|x/sys'go build ./...go test ./... -run TLS|Crypto|Sys -count=1
🤖 Prompt for AI Agents
In go.mod around lines 366 to 371: the build is failing because
pkg/output/stats/waf/waf.go (line 27) tries to load regexes.json but the file is
missing; either add the missing regexes.json at pkg/output/stats/waf/ with the
expected JSON content or update waf.go to reference the correct existing path
(or embed resource) so the file can be found at runtime; after making the
change, run the provided validation commands: rg -nP --type=go -C2
'golang\.org/x/crypto|crypto/tls|x/sys', go build ./..., and go test ./... -run
TLS|Crypto|Sys -count=1 to confirm the build and tests pass.
|
FYI @dogancanbakir - this doesn’t actually fix the compat issue, see #6438. |
|
@dwisiswant0 I see, awk. I ran the same cmd in local but didn't get that error. Could you open a new issue for it? Thanks! |
|
ctx: https://github.com/projectdiscovery/nuclei/actions/runs/17222777779/job/48861493818?pr=6424
Summary by CodeRabbit