Skip to content

fix(security): update module golang.org/x/crypto to v0.45.0 [security]#1826

Merged
toddbaert merged 2 commits into
mainfrom
renovate/vulnerability-updates
Dec 23, 2025
Merged

fix(security): update module golang.org/x/crypto to v0.45.0 [security]#1826
toddbaert merged 2 commits into
mainfrom
renovate/vulnerability-updates

Conversation

@renovate

@renovate renovate Bot commented Nov 20, 2025

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
golang.org/x/crypto v0.39.0 -> v0.45.0 age confidence

GitHub Vulnerability Alerts

CVE-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

CVE-2025-47914

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled because a matching PR was automerged previously.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label Nov 20, 2025
@renovate renovate Bot requested a review from a team as a code owner November 20, 2025 09:34
@renovate

renovate Bot commented Nov 20, 2025

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: flagd/go.sum
Command failed: go get -t ./...
go: downloading buf.build/gen/go/open-feature/flagd/connectrpc/go v1.18.1-20250529171031-ebdc14163473.1
go: downloading github.com/rs/xid v1.6.0
go: downloading github.com/stretchr/testify v1.10.0
go: downloading go.uber.org/mock v0.5.2
go: downloading github.com/gorilla/mux v1.8.1
go: downloading github.com/rs/cors v1.11.1
go: downloading github.com/cpuguy83/go-md2man/v2 v2.0.6
go: downloading github.com/diegoholiveira/jsonlogic/v3 v3.8.4
go: downloading github.com/twmb/murmur3 v1.1.8
go: downloading github.com/zeebo/xxh3 v1.0.2
go: downloading golang.org/x/mod v0.29.0
go: downloading connectrpc.com/otelconnect v0.7.2
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/russross/blackfriday/v2 v2.1.0
go: downloading github.com/barkimedes/go-deepcopy v0.0.0-20220514131651-17c30cfc62df
go: downloading github.com/klauspost/cpuid/v2 v2.2.7
go: downloading go.opentelemetry.io/proto/otlp v1.7.0
go: downloading github.com/cenkalti/backoff/v5 v5.0.2
go: downloading github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1
go: downloading github.com/open-feature/flagd/core v0.12.1
go: downloading github.com/open-feature/flagd v0.4.2
go: github.com/open-feature/flagd/flagd/pkg/service/flag-evaluation imports
	github.com/open-feature/flagd/core/pkg/notifications: cannot find module providing package github.com/open-feature/flagd/core/pkg/notifications
go: warning: go.opentelemetry.io/otel/exporters/prometheus@v0.59.0: retracted by module author: v0.59.0 produces incorrect metric names when bracketed units are used.
go: to switch to the latest unretracted version, run:
	go get go.opentelemetry.io/otel/exporters/prometheus@latest

@renovate renovate Bot requested a review from a team as a code owner November 20, 2025 09:34
@renovate renovate Bot added the renovate label Nov 20, 2025
@netlify

netlify Bot commented Nov 20, 2025

Copy link
Copy Markdown

Deploy Preview for polite-licorice-3db33c canceled.

Name Link
🔨 Latest commit 33120b9
🔍 Latest deploy log https://app.netlify.com/projects/polite-licorice-3db33c/deploys/694af9564f4fe70009723c0f

@renovate renovate Bot force-pushed the renovate/vulnerability-updates branch 2 times, most recently from de61633 to 49c47fa Compare December 8, 2025 22:47
@renovate renovate Bot force-pushed the renovate/vulnerability-updates branch 2 times, most recently from ee53565 to 03bd66e Compare December 15, 2025 18:04
@renovate renovate Bot force-pushed the renovate/vulnerability-updates branch from 03bd66e to c03f822 Compare December 22, 2025 20:30
@renovate renovate Bot force-pushed the renovate/vulnerability-updates branch from c03f822 to 1a6d690 Compare December 22, 2025 21:54
@dosubot dosubot Bot added the size:M This PR changes 30-99 lines, ignoring generated files. label Dec 23, 2025
@renovate

renovate Bot commented Dec 23, 2025

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
@toddbaert toddbaert force-pushed the renovate/vulnerability-updates branch from 495661b to 33120b9 Compare December 23, 2025 20:19
@sonarqubecloud

Copy link
Copy Markdown

@toddbaert toddbaert merged commit 7e0762b into main Dec 23, 2025
17 checks passed
@github-actions github-actions Bot mentioned this pull request Dec 23, 2025
toddbaert added a commit that referenced this pull request Dec 24, 2025
🤖 I have created a release *beep* *boop*
---


<details><summary>flagd: 0.13.0</summary>

##
[0.13.0](flagd/v0.12.9...flagd/v0.13.0)
(2025-12-23)


### 🐛 Bug Fixes

* fixing sync return format missing flag layer, adding full e2e suite
([#1827](#1827))
([570693d](570693d))
* **security:** update module github.com/go-viper/mapstructure/v2 to
v2.4.0 [security]
([#1784](#1784))
([037e30b](037e30b))
* **security:** update module golang.org/x/crypto to v0.45.0 [security]
([#1826](#1826))
([7e0762b](7e0762b))


### ✨ New Features

* add support for http-based ofrep metrics
([#1803](#1803))
([fcd19b3](fcd19b3))
* cleanup evaluator interface
([#1793](#1793))
([aa504f7](aa504f7))
* enable parsing of array flag configurations for flagd
([#1797](#1797))
([97c6ffa](97c6ffa))
* multi-project support via selectors and flagSetId namespacing
([#1702](#1702))
([f9ce46f](f9ce46f))
* normalize selector in sync (use header as in OFREP and RPC)
([#1815](#1815))
([c1f06cb](c1f06cb))


### 🧹 Chore

* **refactor:** use memdb for flag storage
([#1697](#1697))
([5c5c1cf](5c5c1cf))


### 🔄 Refactoring

* store cleanup
([#1705](#1705))
([bcff8d7](bcff8d7))
</details>

<details><summary>flagd-proxy: 0.8.1</summary>

##
[0.8.1](flagd-proxy/v0.8.0...flagd-proxy/v0.8.1)
(2025-12-23)


### 🐛 Bug Fixes

* **security:** update module github.com/go-viper/mapstructure/v2 to
v2.4.0 [security]
([#1784](#1784))
([037e30b](037e30b))
* **security:** update module golang.org/x/crypto to v0.45.0 [security]
([#1826](#1826))
([7e0762b](7e0762b))
</details>

<details><summary>core: 0.13.0</summary>

##
[0.13.0](core/v0.12.1...core/v0.13.0)
(2025-12-23)


### ⚠ BREAKING CHANGES

* enable parsing of array flag configurations for flagd
([#1797](#1797))
* cleanup evaluator interface
([#1793](#1793))
* removes the `fractionalEvaluation` operator since it has been replaced
with `fractional`.
([#1704](#1704))

### 🐛 Bug Fixes

* **security:** update module github.com/go-viper/mapstructure/v2 to
v2.4.0 [security]
([#1784](#1784))
([037e30b](037e30b))
* **security:** update module golang.org/x/crypto to v0.45.0 [security]
([#1825](#1825))
([44edcc9](44edcc9))
* **security:** update module golang.org/x/crypto to v0.45.0 [security]
([#1826](#1826))
([7e0762b](7e0762b))


### ✨ New Features

* Add OAuth support for HTTP Sync
([#1791](#1791))
([268fd75](268fd75))
* Add OTEL default variables
([#1812](#1812))
([c2e3fc6](c2e3fc6))
* allow null flagSetId Selector, restrict Selector to single
key-value-pairs
([#1708](#1708))
([#1811](#1811))
([c12a0ae](c12a0ae))
* change jsonschema parser
([#1794](#1794))
([bf3f722](bf3f722))
* cleanup evaluator interface
([#1793](#1793))
([aa504f7](aa504f7))
* enable parsing of array flag configurations for flagd
([#1797](#1797))
([97c6ffa](97c6ffa))
* multi-project support via selectors and flagSetId namespacing
([#1702](#1702))
([f9ce46f](f9ce46f))


### 🧹 Chore

* **refactor:** use memdb for flag storage
([#1697](#1697))
([5c5c1cf](5c5c1cf))
* removes the `fractionalEvaluation` operator since it has been replaced
with `fractional`.
([#1704](#1704))
([3228ad8](3228ad8))


### 🔄 Refactoring

* remove deprecated bearerToken option
([#1816](#1816))
([efda06a](efda06a))
* removed unused Selector from Flag and Store.
([#1747](#1747))
([1083005](1083005))
* store cleanup
([#1705](#1705))
([bcff8d7](bcff8d7))
</details>

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Signed-off-by: OpenFeature Bot <109696520+openfeaturebot@users.noreply.github.com>
Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Todd Baert <todd.baert@dynatrace.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

renovate size:M This PR changes 30-99 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant