From 57a9d139ac1ca145bcfffaeb1e5c9a92862bac40 Mon Sep 17 00:00:00 2001 From: boazgarty Date: Sat, 12 Sep 2026 19:15:58 +0300 Subject: [PATCH] fix(deps): bump golang.org/x/crypto past 9 known CVEs (7 critical) This library's entire purpose is wrapping golang.org/x/crypto/scrypt, so its own supply-chain hygiene on that exact dependency matters more than usual here. Pinned at v0.31.0, affected by 9 published advisories fixed in v0.52.0, 7 of them CRITICAL: - GHSA-5cgq-3rg8-m6cv, GHSA-89gr-r52h-f8rx, GHSA-f5wc-c3c7-36mc, GHSA-jppx-rxg9-jmrx, GHSA-rm3j-f69w-wqmq, GHSA-vgwf-h737-ff37, GHSA-x527-x647-q7gg (CRITICAL) - GHSA-hcg3-q754-cr77, GHSA-w879-237q-wc7r (HIGH) Bumped to v0.55.0 rather than the latest v0.57.0: two further advisories fix only at v0.56.0 and both are golang.org/x/crypto/ssh- specific (this package imports only x/crypto/scrypt), and v0.56.0+ requires go>=1.26.0 vs v0.55.0's go>=1.25.0 -- a smaller toolchain-floor bump for a fix that doesn't need the extra two. `go` directive raised 1.21 -> 1.25.0 accordingly (every x/crypto release >=0.52.0 requires go>=1.25). Not touched: golang.org/x/crypto/openpgp's own advisory (GO-2026-5932, "unmaintained, unsafe by design," no fixed version at any release) -- this package doesn't import that subpackage. Verified: `go build ./...` succeeds; `go test ./...` passes cleanly (the package's own scrypt round-trip tests), zero failures. Found via `scan --path . --sca` (OSV-Scanner + Trivy, cross-confirmed). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01MwAHVxFqbmhkPYR6dP5JuQ --- go.mod | 4 ++-- go.sum | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index 5db6156..5fc4ba8 100644 --- a/go.mod +++ b/go.mod @@ -1,5 +1,5 @@ module github.com/elithrar/simple-scrypt -go 1.21 +go 1.25.0 -require golang.org/x/crypto v0.31.0 +require golang.org/x/crypto v0.55.0 diff --git a/go.sum b/go.sum index 9615005..a6e2343 100644 --- a/go.sum +++ b/go.sum @@ -1,2 +1,2 @@ -golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U= -golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=