Skip to content

build(go): update module golang.org/x/crypto to v0.45.0 [security] #432

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
renovate wants to merge 1 commit into from
Closed

build(go): update module golang.org/x/crypto to v0.45.0 [security] #432

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 20, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
golang.org/x/crypto v0.42.0 -> v0.45.0 age confidence

GitHub Vulnerability Alerts

CVE-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

CVE-2025-47914

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the security label Nov 20, 2025
@renovate
Copy link
Contributor Author

renovate bot commented Nov 20, 2025

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/sys v0.36.0 -> v0.38.0
golang.org/x/net v0.44.0 -> v0.47.0
golang.org/x/text v0.29.0 -> v0.31.0

@github-actions
Copy link

github-actions bot commented Nov 20, 2025 •
edited
Loading

🚀 Dev Builds Available

Development builds for this PR are available in the workflow artifacts.

Available builds:

  • Windows (agent, installer, tray)
  • Linux (agent)
  • macOS (agent)

Download the build artifact to test the latest changes.

@renovate
Copy link
Contributor Author

renovate bot commented Dec 12, 2025

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/sys v0.36.0 -> v0.38.0
golang.org/x/net v0.44.0 -> v0.47.0
golang.org/x/text v0.29.0 -> v0.31.0

@renovate renovate bot force-pushed the renovate/go-golang.org-x-crypto-vulnerability branch from 0137277 to f6f7736 Compare December 12, 2025 10:17
@dz0ny dz0ny closed this Dec 12, 2025
@renovate
Copy link
Contributor Author

renovate bot commented Dec 12, 2025

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v0.45.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate bot deleted the renovate/go-golang.org-x-crypto-vulnerability branch December 12, 2025 10:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dz0ny