Repository navigation
chore(deps)!: fix Trivy security findings - #45
Merged
Merged
Conversation
- Upgrade x/crypto to v0.56.0 to fix two SSH denial-of-service vulnerabilities - Require Go 1.26 across affected modules BREAKING CHANGE: Go 1.26 or newer is now required by x/crypto v0.56.0. Upgrade the Go toolchain before building.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Trivy fails on CVE-2026-56855 and CVE-2026-78662 in
golang.org/x/crypto v0.55.0. Upgrade every affected module tov0.56.0and refresh module checksums.Compatibility change: the new x/crypto release requires Go 1.26. Affected modules now declare
go 1.26.0; applicable CI settings and documented minimum versions are aligned. Application source and scanner severity settings are unchanged.Goal and scope: fix the dependency vulnerabilities reported by Trivy in this repository, including nested example modules. No related issue was supplied.
Verification
Setup
Check out
chore/fix-trivy-security-dependenciesand start in the repository root. Use Go 1.26+ (tested with Go 1.26.7 andGOTOOLCHAIN=local) and Trivy (tested with 0.69.3 and a freshly downloaded database on 2026-09-20). Use a clean checkout without stale locally compiled binaries.Automated checks
Run the test command from each directory listed below (paths are relative to the repository root). Exit 0 means the module compiles and all available tests pass.
.go test -mod=readonly -p 2 -timeout 90s ./...From the repository root:
trivy fs --scanners vuln,secret,misconfig --severity CRITICAL,HIGH,MEDIUM --ignore-unfixed --exit-code 1 --skip-dirs .claude --skip-dirs .git --skip-dirs node_modules . git diff --checkSecurity regression check
go list -m golang.org/x/crypto. Expected:golang.org/x/crypto v0.56.0. Observed: dependency version verified in every updated manifest.No production data or credentials are used. Go/Trivy populate local caches; no application cleanup is needed.
AI authorship
go.mod,go.sum.Change classification and review
Core: shared security dependencies and a minimum toolchain change. Request two reviewers including the module owner. Review the Go minimum, dependency versions and CI settings; spot-check generated checksums. No application permission, auth-flow or external-interface logic was modified. No secrets or unrelated local files are included.
Risk and rollback
Go 1.25 users must upgrade to Go 1.26+. Existing APIs are unchanged, but dependency behavior and runtime compatibility need CI review. Revert this commit to restore the prior dependency/toolchain requirements; doing so restores the reported vulnerabilities.
References