Skip to content

chore(deps): Bump github.com/gopacket/gopacket from 1.7.2 to 1.7.4 - #19836

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/gopacket/gopacket-1.7.4
Open

chore(deps): Bump github.com/gopacket/gopacket from 1.7.2 to 1.7.4#19836
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/gopacket/gopacket-1.7.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github.com/gopacket/gopacket from 1.7.2 to 1.7.4.

Release notes

Sourced from github.com/gopacket/gopacket's releases.

v1.7.4

Security release. v1.7.3 did not fully fix GTPv2 decoding. Upgrade if you decode untrusted GTPv2 traffic.

Security fixes

Advisory Area
GHSA-xcf2-23pj-86cv GTPv2. v1.7.3 fixed the IE header but left one bound short

A GTPv2 message that ended right after the 3-byte sequence number still caused an out-of-bounds panic, because the decoder read the following spare byte without checking for it. The decoder now requires the spare byte and returns a decode error instead.

Exposure: gopacket.NewPacket with default options and DecodingLayerParser with IgnorePanic: false both recover, so those callers saw a decode error. A process crash needed SkipDecodeRecovery: true or IgnorePanic: true.

Other fixes

  • USBRequestBlockSetup returns a truncated error on input shorter than 8 bytes instead of panicking (#169)
  • pcap: Handle.Close no longer hangs while ReadPacketData is blocked on a handle opened with BlockForever. The blocked read returns io.EOF. This applies on Linux with libpcap 1.10 or later and on Npcap. Other platforms behave as before (#27)
  • pcap: darwin builds no longer pass -lpcap to the linker twice (#171)

No API changes.

v1.7.3

v1.7.3 was tagged without release notes. It fixed GHSA-xcf2-23pj-86cv (sFlow, OSPFv2/v3, MDP, GTPv2, Geneve and CDP decoders), GHSA-r93c-g7pr-x4hw (DHCPv6 option String() and STP SerializeTo) and GHSA-w3r9-77cj-r246 (Diameter grouped-AVP recursion).

Credits

The remaining GTPv2 case was reported by @​ChrisJr404. USB fix by @​chiliec.

Commits
  • 11ee6a1 Revert "packet: set zeroCopy in NewZeroCopyPacketSource (#172)"
  • 3541dd1 layers/gtp2: require the spare byte before reading it
  • 583e398 pcap: let Close return while a read is blocked
  • c39583a pcap: stop linking -lpcap twice on darwin
  • f8c0188 packet: set zeroCopy in NewZeroCopyPacketSource (#172)
  • 8c0424b fix(layers): guard USBRequestBlockSetup against short input (#169)
  • 2029b6a ci: move to ubuntu-26.04 and make the lint gate real
  • d4b61d8 layers/diameter: cap grouped AVP nesting depth
  • 07e9da8 layers: stop DHCPv6 String and STP SerializeTo panics
  • 0701061 layers: bound seven more decoders on crafted input
  • See full diff in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 5, 2026
@telegraf-tiger telegraf-tiger Bot added the chore label Oct 5, 2026
@dependabot
chore(deps): Bump github.com/gopacket/gopacket from 1.7.2 to 1.7.4
568bdb7 
Bumps [github.com/gopacket/gopacket](https://github.com/gopacket/gopacket) from 1.7.2 to 1.7.4.
- [Release notes](https://github.com/gopacket/gopacket/releases)
- [Commits](gopacket/gopacket@v1.7.2...v1.7.4)

---
updated-dependencies:
- dependency-name: github.com/gopacket/gopacket
  dependency-version: 1.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/github.com/gopacket/gopacket-1.7.4 branch from 80c7a52 to 568bdb7 Compare October 6, 2026 07:07
@telegraf-tiger

telegraf-tiger Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Download PR build artifacts for linux_amd64.tar.gz, darwin_arm64.tar.gz, and windows_amd64.zip.
Downloads for additional architectures and packages are available below.

⚠️ This pull request increases the Telegraf binary size by 5.83 % for linux amd64 (new size: 326.2 MB, nightly size 308.2 MB)

📦 Click here to get additional PR build artifacts

Artifact URLs

. DEB . RPM . TAR . GZ . ZIP
amd64.deb aarch64.rpm darwin_amd64.tar.gz windows_amd64.zip
arm64.deb armel.rpm darwin_arm64.tar.gz windows_arm64.zip
armel.deb armv6hl.rpm freebsd_amd64.tar.gz windows_i386.zip
armhf.deb i386.rpm freebsd_armv7.tar.gz
i386.deb ppc64le.rpm freebsd_i386.tar.gz
mips.deb riscv64.rpm linux_amd64.tar.gz
mipsel.deb s390x.rpm linux_arm64.tar.gz
ppc64el.deb x86_64.rpm linux_armel.tar.gz
riscv64.deb linux_armhf.tar.gz
s390x.deb linux_i386.tar.gz
linux_mips.tar.gz
linux_mipsel.tar.gz
linux_ppc64le.tar.gz
linux_riscv64.tar.gz
linux_s390x.tar.gz

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

chore dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants