fix: upgrade golang.org/x/image to 0.43.0 (CVE-2026-46602)

[anupamme]

Summary

Upgrade golang.org/x/image from v0.39.0 to 0.43.0 to fix CVE-2026-46602.

Vulnerability

Field	Value
ID	CVE-2026-46602
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-46602
File	go.mod (dependency: golang.org/x/image)
Assessment	Present in dependency tree, not confirmed reachable

Description: The TIFF decoder does not set a limit on the size of tiles in tiled im ...

Evidence

Scanner confirmation: trivy rule CVE-2026-46602 flagged this pattern.

Changes

• go.mod
• go.sum

Behavior Preservation

The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e3fe1f88-c0e6-4d67-b84e-c5f609afd3b9

📥 Commits

Reviewing files that changed from the base of the PR and between 3b8d255 and c65be75.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

---

Walkthrough

Updated four Go module dependencies in go.mod: golang.org/x/mod, golang.org/x/sync, golang.org/x/image, and golang.org/x/text. The versions of golang.org/x/net and golang.org/x/oauth2 remain unchanged.

Suggested reviewers: boojack

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: upgrading golang.org/x/image to address CVE-2026-46602.
Description check	✅ Passed	The description directly explains the dependency upgrade, vulnerability, scanner finding, scope, and expected behavior preservation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR upgrades golang.org/x/image to v0.43.0 to address the reported TIFF decoder vulnerability and refreshes related Go module requirements and checksums.

• Upgrades golang.org/x/image from v0.39.0 to v0.43.0.
• Updates selected golang.org/x/mod, x/sync, and x/text requirements.
• Regenerates go.sum entries for the resolved module graph.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code-triggered failure identified.

The dependency update replaces the x/image TIFF decoder used by the reachable attachment-processing path, while the other investigated advisory paths either predate the PR or lack evidence of being introduced or worsened by these version changes.

Important Files Changed

Filename	Overview
go.mod	Updates x/image and related Go module versions; no changed-code regression was established.
go.sum	Adds checksums corresponding to the refreshed module graph without changing runtime code.

_{Reviews (1): Last reviewed commit: "fix: CVE-2026-46602 security vulnerabili..." | Re-trigger Greptile}