webmatix/dotrig
Watch
1
0
Fork
You've already forked dotrig
 0
Code Issues 1 Pull requests Projects Releases Packages 1 Wiki Activity

chore(deps): update module golang.org/x/crypto from v0.53.0 to v0.55.0 [security] #9

Merged
webmatix-renovate merged 1 commit from renovate/go-golang.org-x-crypto-vulnerability into main 2026-09-02 20:31:11 +02:00
Conversation 1 Commits 1 Files changed 2 +9 -3
webmatix-renovate commented 2026-09-02 20:31:11 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Type Update Change
golang.org/x/crypto indirect minor v0.53.0 → v0.55.0

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

CVE-2026-56854 / GO-2026-6303

More information

Details

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Configuration

📅 Schedule: (in timezone Europe/Vienna)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [golang.org/x/crypto](https://go.googlesource.com/crypto) | indirect | minor | `v0.53.0` → `v0.55.0` | --- ### Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh [CVE-2026-56854](https://nvd.nist.gov/vuln/detail/CVE-2026-56854) / [GO-2026-6303](https://pkg.go.dev/vuln/GO-2026-6303) <details> <summary>More information</summary> #### Details The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback. #### Severity Unknown #### References - [https://go.dev/issue/80213](https://go.dev/issue/80213) - [https://go.dev/cl/797040](https://go.dev/cl/797040) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6303) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Vienna) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
chore(deps): update module golang.org/x/crypto from v0.53.0 to v0.55.0 [security]
All checks were successful
ci/woodpecker/push/ci Pipeline was successful
Details
0856d54ca2
webmatix-renovate scheduled this pull request to auto merge when all checks succeed 2026-09-02 20:31:11 +02:00
webmatix-renovate commented 2026-09-02 20:31:11 +02:00
Author
Collaborator
Copy link

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.56.0 -> v0.57.0
golang.org/x/sys v0.46.0 -> v0.47.0
### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 2 additional dependencies were updated Details: | **Package** | **Change** | | :----------------- | :--------------------- | | `golang.org/x/net` | `v0.56.0` -> `v0.57.0` | | `golang.org/x/sys` | `v0.46.0` -> `v0.47.0` |
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
webmatix/dotrig!9
No description provided.