sixfold-space/madtea
sixfold-space/madtea
SHA256
2
0
Fork 0
Code Issues 221 Pull requests Projects Releases 13 Packages Wiki Activity Actions 9

chore(deps): upgrade golang.org/x/crypto, mod, and text past known vulnerabilities #620

Merged
hexajon merged 1 commit from chore/bump-x-crypto-mod-text into main 2026-09-24 15:43:55 +00:00
Conversation 0 Commits 1 Files changed 3 +30 -30
hexajon commented 2026-09-24 15:43:53 +00:00
Owner
Copy link

Summary

A lockfile-level osv-scanner scan (--no-call-analysis=all) found 7 known vulnerabilities in go.mod: GO-2026-5932, -6303, -6354, and -6355 in golang.org/x/crypto v0.52.0; GO-2026-6179 and -6180 in golang.org/x/mod v0.35.0; and GO-2026-5970 in golang.org/x/text v0.37.0. madtea does not reach them, which is why govulncheck reports nothing, but they ship in the build.

This upgrades x/crypto to v0.57.0, x/mod to v0.41.0, and x/text to v0.42.0. x/sync, x/sys, x/term, x/tools, and x/net move up with them. Every change is an upgrade. THIRD-PARTY-LICENSES.md records the new versions; all are BSD-3-Clause.

After the upgrade the scan reports one finding: GO-2026-5932 in x/crypto, which has no fixed version yet. The gate is green.

Refs #587

## Summary A lockfile-level osv-scanner scan (`--no-call-analysis=all`) found 7 known vulnerabilities in `go.mod`: GO-2026-5932, -6303, -6354, and -6355 in `golang.org/x/crypto` v0.52.0; GO-2026-6179 and -6180 in `golang.org/x/mod` v0.35.0; and GO-2026-5970 in `golang.org/x/text` v0.37.0. madtea does not reach them, which is why govulncheck reports nothing, but they ship in the build. This upgrades `x/crypto` to v0.57.0, `x/mod` to v0.41.0, and `x/text` to v0.42.0. `x/sync`, `x/sys`, `x/term`, `x/tools`, and `x/net` move up with them. Every change is an upgrade. `THIRD-PARTY-LICENSES.md` records the new versions; all are BSD-3-Clause. After the upgrade the scan reports one finding: GO-2026-5932 in `x/crypto`, which has no fixed version yet. The gate is green. Refs #587
chore(deps): upgrade golang.org/x/crypto, mod, and text past known vulnerabilities
All checks were successful
ci / mcp-conformance (pull_request) Successful in 1m26s
Details
drift / govulncheck (pull_request) Has been skipped
Details
drift / forgejo-smoke (pull_request) Has been skipped
Details
drift / surface-diff (pull_request) Successful in 1m15s
Details
ci / mcp-conformance (push) Successful in 0s
Details
drift / govulncheck (push) Has been skipped
Details
drift / surface-diff (push) Successful in 8s
Details
drift / forgejo-smoke (push) Has been skipped
Details
ci / gate (pull_request) Successful in 30m5s
Details
ci / gate (push) Successful in 18m15s
Details
b557dcdc26
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
breaking
Breaking change - flag for release notes

  
bug
Something is not working

  
documentation
Documentation only

  
enhancement
New feature

  
epic
Tracking epic with dependency children

  
good first issue
Interested in contributing? Get started here.

  
help wanted
Maintainer would welcome outside help

  
refactoring
Code restructuring without behavior changes

  
resolution/duplicate
Closed as duplicate of another issue

  
resolution/invalid
Closed as invalid or not reproducible

  
resolution/wontfix
Closed as won't fix

  
security
Security issue or hardening

  
severity/critical
Security severity: critical

  
severity/high
Security severity: high

  
severity/low
Security severity: low

  
severity/medium
Security severity: medium

  
status/abandoned
Someone started, then walked away - up for grabs

  
status/blocked
Blocked by another issue or an external dependency

  
status/needs-decision
Waiting on a maintainer decision; workable once decided

  
status/needs-info
Waiting on reporter / more information before work can start

  
status/needs-verification
Done except verification in a live interactive session

  
testing
Test suite / CI infrastructure work

  
upstream
Related to an upstream repository, already reported there

No labels
breaking
bug
documentation
enhancement
epic
good first issue
help wanted
refactoring
resolution/duplicate
resolution/invalid
resolution/wontfix
security
severity/critical
severity/high
severity/low
severity/medium
status/abandoned
status/blocked
status/needs-decision
status/needs-info
status/needs-verification
testing
upstream
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
sixfold-space/madtea!620
No description provided.