security: bump golang.org/x/crypto to v0.52.0 (critical SSH CVEs) - #2397
Open
DjamilaBaroudi wants to merge 1 commit into
Open
security: bump golang.org/x/crypto to v0.52.0 (critical SSH CVEs)#2397DjamilaBaroudi wants to merge 1 commit into
DjamilaBaroudi wants to merge 1 commit into
Conversation
Resolves the open Dependabot alerts for golang.org/x/crypto (< 0.52.0), including several critical SSH-related advisories (auth bypass via unenforced revoked status, agent/key constraint enforcement, FIDO/U2F presence-check bypass) plus high/medium DoS and panic issues. x/crypto is an indirect dependency; this is a backward-compatible minor bump with no API changes. Applied to the main module and the starrocks/sail/doris cloud integration-test modules. go mod tidy pulled matching transitive versions (otel/sys/text in sail) and reclassified moby/moby/api as a direct require in doris/starrocks. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Prompt To Fix All With AIFix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
integration-tests/cloud-integration-tests/doris/go.sum:1
**go.sum changes wider than described**
Beyond the stated crypto/moby/otel changes, `go mod tidy` also upgraded several integration-test transitive dependencies: `apache/arrow-adbc/go/adbc` jumped from a pre-release commit (`v0.0.0-20251120`) to `v1.11.0`, `snowflakedb/gosnowflake` from v1.17.1 to v1.19.0, `databricks/databricks-sql-go` from v1.9.0 to v1.10.0, and multiple GCP libraries (auth, bigquery, storage, iam, longrunning, monitoring). These aren't mentioned in the PR description and represent real version changes in the module graph used by the doris and starrocks integration tests. Confirm that CI runs these integration tests cleanly with the new dep tree before merging.
Reviews (1): Last reviewed commit: "security: bump golang.org/x/crypto to v0..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps
golang.org/x/cryptofromv0.51.0/v0.48.0tov0.52.0across all four Go modules in the repo, resolving the open Dependabot alerts for this package.Why
Dependabot flagged 13 alerts per module on
golang.org/x/crypto < 0.52.0. The critical ones are SSH-related:@revokedstatus (GHSA-5cgq-3rg8-m6cv)VerifiedPublicKeyCallbackpermission skip (GHSA-x527-x647-q7gg)Plus high/medium DoS and panic advisories. All fixed in
v0.52.0.Modules updated
go.mod(shipped binary)integration-tests/cloud-integration-tests/{starrocks,sail,doris}/go.modIs it breaking?
No.
x/cryptois an indirect dependency (no Bruin code imports it directly) and0.51 → 0.52is a backward-compatible minor release.go build ./...compiles cleanly andgo mod verifypasses.go mod tidyadditionally pulled matching transitive versions (otel/sys/text in sail) and reclassifiedmoby/moby/apias a direct require in doris/starrocks.