fix(security): update module golang.org/x/crypto to v0.45.0 [security]#1826
Merged
Conversation
Contributor
Author
|
✅ Deploy Preview for polite-licorice-3db33c canceled.
|
de61633 to
49c47fa
Compare
ee53565 to
03bd66e
Compare
03bd66e to
c03f822
Compare
c03f822 to
1a6d690
Compare
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
495661b to
33120b9
Compare
|
toddbaert
approved these changes
Dec 23, 2025
Merged
toddbaert
added a commit
that referenced
this pull request
Dec 24, 2025
🤖 I have created a release *beep* *boop* --- <details><summary>flagd: 0.13.0</summary> ## [0.13.0](flagd/v0.12.9...flagd/v0.13.0) (2025-12-23) ### 🐛 Bug Fixes * fixing sync return format missing flag layer, adding full e2e suite ([#1827](#1827)) ([570693d](570693d)) * **security:** update module github.com/go-viper/mapstructure/v2 to v2.4.0 [security] ([#1784](#1784)) ([037e30b](037e30b)) * **security:** update module golang.org/x/crypto to v0.45.0 [security] ([#1826](#1826)) ([7e0762b](7e0762b)) ### ✨ New Features * add support for http-based ofrep metrics ([#1803](#1803)) ([fcd19b3](fcd19b3)) * cleanup evaluator interface ([#1793](#1793)) ([aa504f7](aa504f7)) * enable parsing of array flag configurations for flagd ([#1797](#1797)) ([97c6ffa](97c6ffa)) * multi-project support via selectors and flagSetId namespacing ([#1702](#1702)) ([f9ce46f](f9ce46f)) * normalize selector in sync (use header as in OFREP and RPC) ([#1815](#1815)) ([c1f06cb](c1f06cb)) ### 🧹 Chore * **refactor:** use memdb for flag storage ([#1697](#1697)) ([5c5c1cf](5c5c1cf)) ### 🔄 Refactoring * store cleanup ([#1705](#1705)) ([bcff8d7](bcff8d7)) </details> <details><summary>flagd-proxy: 0.8.1</summary> ## [0.8.1](flagd-proxy/v0.8.0...flagd-proxy/v0.8.1) (2025-12-23) ### 🐛 Bug Fixes * **security:** update module github.com/go-viper/mapstructure/v2 to v2.4.0 [security] ([#1784](#1784)) ([037e30b](037e30b)) * **security:** update module golang.org/x/crypto to v0.45.0 [security] ([#1826](#1826)) ([7e0762b](7e0762b)) </details> <details><summary>core: 0.13.0</summary> ## [0.13.0](core/v0.12.1...core/v0.13.0) (2025-12-23) ### ⚠ BREAKING CHANGES * enable parsing of array flag configurations for flagd ([#1797](#1797)) * cleanup evaluator interface ([#1793](#1793)) * removes the `fractionalEvaluation` operator since it has been replaced with `fractional`. ([#1704](#1704)) ### 🐛 Bug Fixes * **security:** update module github.com/go-viper/mapstructure/v2 to v2.4.0 [security] ([#1784](#1784)) ([037e30b](037e30b)) * **security:** update module golang.org/x/crypto to v0.45.0 [security] ([#1825](#1825)) ([44edcc9](44edcc9)) * **security:** update module golang.org/x/crypto to v0.45.0 [security] ([#1826](#1826)) ([7e0762b](7e0762b)) ### ✨ New Features * Add OAuth support for HTTP Sync ([#1791](#1791)) ([268fd75](268fd75)) * Add OTEL default variables ([#1812](#1812)) ([c2e3fc6](c2e3fc6)) * allow null flagSetId Selector, restrict Selector to single key-value-pairs ([#1708](#1708)) ([#1811](#1811)) ([c12a0ae](c12a0ae)) * change jsonschema parser ([#1794](#1794)) ([bf3f722](bf3f722)) * cleanup evaluator interface ([#1793](#1793)) ([aa504f7](aa504f7)) * enable parsing of array flag configurations for flagd ([#1797](#1797)) ([97c6ffa](97c6ffa)) * multi-project support via selectors and flagSetId namespacing ([#1702](#1702)) ([f9ce46f](f9ce46f)) ### 🧹 Chore * **refactor:** use memdb for flag storage ([#1697](#1697)) ([5c5c1cf](5c5c1cf)) * removes the `fractionalEvaluation` operator since it has been replaced with `fractional`. ([#1704](#1704)) ([3228ad8](3228ad8)) ### 🔄 Refactoring * remove deprecated bearerToken option ([#1816](#1816)) ([efda06a](efda06a)) * removed unused Selector from Flag and Store. ([#1747](#1747)) ([1083005](1083005)) * store cleanup ([#1705](#1705)) ([bcff8d7](bcff8d7)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Signed-off-by: OpenFeature Bot <109696520+openfeaturebot@users.noreply.github.com> Signed-off-by: Todd Baert <todd.baert@dynatrace.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Todd Baert <todd.baert@dynatrace.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.



This PR contains the following updates:
v0.39.0->v0.45.0GitHub Vulnerability Alerts
CVE-2025-58181
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
CVE-2025-47914
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled because a matching PR was automerged previously.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.