Skip to content

fix(deps): vuln minor upgrades — 12 packages (minor: 11 · patch: 1) - #70

Draft
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/1-1784559265
Draft

fix(deps): vuln minor upgrades — 12 packages (minor: 11 · patch: 1) #70
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/1-1784559265

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Jul 20, 2026

Copy link
Copy Markdown

Summary: Critical-severity security update — 12 packages upgraded (MINOR changes included)

Manifests changed:

  • . (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
golang.org/x/crypto v0.14.0 v0.54.0 minor Direct 24 CRITICAL, 10 HIGH, 22 MEDIUM, 1 UNKNOWN
google.golang.org/grpc v1.55.0 v1.82.1 minor Transitive 3 CRITICAL, 2 HIGH
golang.org/x/net v0.17.0 v0.57.0 minor Transitive 2 CRITICAL, 4 HIGH, 19 MEDIUM, 1 UNKNOWN
github.com/golang-jwt/jwt/v4 v4.4.2 v4.5.2 minor Transitive 3 HIGH, 3 LOW
github.com/sirupsen/logrus v1.9.0 v1.9.4 patch Direct 3 HIGH
golang.org/x/oauth2 v0.10.0 v0.36.0 minor Transitive 2 HIGH
google.golang.org/protobuf v1.31.0 v1.36.11 minor Transitive 1 HIGH, 1 MEDIUM
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0 v1.14.0 minor Transitive 4 MEDIUM
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9 v1.7.14 minor Transitive 2 MEDIUM
github.com/aws/aws-sdk-go-v2/service/lambda v1.25.0 v1.99.0 minor Transitive 2 MEDIUM
github.com/aws/aws-sdk-go-v2/service/s3 v1.29.3 v1.105.2 minor Transitive 2 MEDIUM
golang.org/x/sys v0.13.0 v0.47.0 minor Transitive 1 UNKNOWN

Security Details

🚨 Critical & High Severity (54 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
golang.org/x/crypto CVE-2026-39833 critical Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent v0.14.0 - -
golang.org/x/crypto CVE-2026-39832 critical Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent v0.14.0 - -
golang.org/x/crypto GHSA-rm3j-f69w-wqmq CRITICAL golang.org/x/crypto vulnerable to infinite loop on large channel writes v0.14.0 0.52.0 -
golang.org/x/crypto CVE-2026-39834 critical Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh v0.14.0 - -
golang.org/x/crypto GO-2026-5020 critical Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh v0.14.0 0.52.0 -
golang.org/x/crypto GO-2024-3321 CRITICAL Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto v0.14.0 0.31.0 -
golang.org/x/crypto CVE-2024-45337 CRITICAL Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto v0.14.0 - -
golang.org/x/crypto GHSA-v778-237x-gjrc CRITICAL Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto v0.14.0 0.31.0 -
golang.org/x/crypto GHSA-5cgq-3rg8-m6cv CRITICAL golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status v0.14.0 0.52.0 -
golang.org/x/crypto CVE-2026-42508 critical Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts v0.14.0 - -
golang.org/x/crypto GO-2026-5021 critical Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts v0.14.0 0.52.0 -
golang.org/x/crypto GHSA-jppx-rxg9-jmrx CRITICAL golang.org/x/crypto doesn't enforce invoking key constraints v0.14.0 0.52.0 -
golang.org/x/crypto CVE-2026-39830 CRITICAL Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh v0.14.0 - -
golang.org/x/crypto GO-2026-5005 critical Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent v0.14.0 0.52.0 -
golang.org/x/crypto GHSA-vgwf-h737-ff37 CRITICAL golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses v0.14.0 0.52.0 -
golang.org/x/crypto GO-2026-5006 critical Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent v0.14.0 0.52.0 -
golang.org/x/crypto GO-2026-5017 CRITICAL Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh v0.14.0 0.52.0 -
golang.org/x/crypto GHSA-f5wc-c3c7-36mc CRITICAL golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys v0.14.0 0.52.0 -
golang.org/x/crypto GHSA-x527-x647-q7gg CRITICAL golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement v0.14.0 0.52.0 -
golang.org/x/crypto CVE-2026-46595 CRITICAL Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh v0.14.0 - -
golang.org/x/crypto GO-2026-5023 CRITICAL Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh v0.14.0 0.52.0 -
golang.org/x/crypto CVE-2026-39831 critical Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh v0.14.0 - -
golang.org/x/crypto GHSA-89gr-r52h-f8rx CRITICAL golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed v0.14.0 0.52.0 -
golang.org/x/crypto GO-2026-5019 critical Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh v0.14.0 0.52.0 -
golang.org/x/net CVE-2026-39821 critical Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.17.0 - -
golang.org/x/net GO-2026-5026 critical Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.17.0 0.55.0 -
google.golang.org/grpc GHSA-p77j-4mvh-x3m3 CRITICAL gRPC-Go has an authorization bypass via missing leading slash in :path v1.55.0 1.79.3 -
google.golang.org/grpc GO-2026-4762 CRITICAL Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc v1.55.0 1.79.3 -
google.golang.org/grpc CVE-2026-33186 CRITICAL gRPC-Go has an authorization bypass via missing leading slash in :path v1.55.0 - -
github.com/golang-jwt/jwt/v4 GO-2025-3553 high Excessive memory allocation during header parsing in github.com/golang-jwt/jwt v4.4.2 4.5.2 -
github.com/golang-jwt/jwt/v4 GHSA-mh63-6h87-95cp HIGH jwt-go allows excessive memory allocation during header parsing v4.4.2 4.5.2 -
github.com/golang-jwt/jwt/v4 CVE-2025-30204 high jwt-go allows excessive memory allocation during header parsing v4.4.2 - -
github.com/sirupsen/logrus GO-2025-4188 high Logrus is vulnerable to DoS when using Entry.writerScanner in github.com/sirupsen/logrus v1.9.0 1.8.3 -
github.com/sirupsen/logrus GHSA-4f99-4q7p-p3gh HIGH Logrus is vulnerable to DoS when using Entry.Writer() v1.9.0 1.8.3 -
github.com/sirupsen/logrus CVE-2025-65637 high - v1.9.0 - -
golang.org/x/crypto GHSA-56w8-48fp-6mgv HIGH golang.org/x/crypto/ssh/agent has a potential denial of service v0.14.0 - -
golang.org/x/crypto GO-2026-5013 HIGH Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh v0.14.0 0.52.0 -
golang.org/x/crypto GHSA-w879-237q-wc7r HIGH golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS v0.14.0 0.52.0 -
golang.org/x/crypto CVE-2026-39829 high Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh v0.14.0 - -
golang.org/x/crypto GO-2026-5018 high Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh v0.14.0 0.52.0 -
golang.org/x/crypto GHSA-hcg3-q754-cr77 HIGH golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange v0.14.0 0.35.0 -
golang.org/x/crypto GO-2025-4116 HIGH Potential denial of service in golang.org/x/crypto/ssh/agent v0.14.0 0.43.0 -
golang.org/x/crypto GO-2025-3487 HIGH Potential denial of service in golang.org/x/crypto v0.14.0 0.35.0 -
golang.org/x/crypto GHSA-q4h4-gmj2-qvw2 HIGH golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic v0.14.0 0.52.0 -
golang.org/x/crypto CVE-2026-46597 HIGH Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh v0.14.0 - -
golang.org/x/net GHSA-w32m-9786-jp63 HIGH Non-linear parsing of case-insensitive content in golang.org/x/net/html v0.17.0 - -
golang.org/x/net GO-2024-3333 HIGH Non-linear parsing of case-insensitive content in golang.org/x/net/html v0.17.0 0.33.0 -
golang.org/x/net CVE-2026-33814 high Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.17.0 - -
golang.org/x/net GO-2026-4918 high Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.17.0 0.53.0 -
golang.org/x/oauth2 GO-2025-3488 HIGH Unexpected memory consumption during token parsing in golang.org/x/oauth2 v0.10.0 0.27.0 -
golang.org/x/oauth2 GHSA-6v2p-p543-phr9 HIGH golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability v0.10.0 0.27.0 -
google.golang.org/grpc GO-2023-2153 HIGH Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc v1.55.0 1.56.3 -
google.golang.org/grpc GHSA-m425-mq94-257g HIGH gRPC-Go HTTP/2 Rapid Reset vulnerability v1.55.0 1.56.3 -
google.golang.org/protobuf GO-2024-2611 high Infinite loop in JSON unmarshaling in google.golang.org/protobuf v1.31.0 1.33.0 -
ℹ️ Other Vulnerabilities (58)
Package CVE Severity Summary Unsafe Version Fixed In Case
github.com/Azure/azure-sdk-for-go/sdk/azidentity PYSEC-2026-1209 medium Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability v1.2.0 - -
github.com/Azure/azure-sdk-for-go/sdk/azidentity CVE-2024-35255 medium - v1.2.0 - -
github.com/Azure/azure-sdk-for-go/sdk/azidentity GO-2024-2918 medium Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0 1.6.0 -
golang.org/x/crypto GO-2026-5016 medium Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh v0.14.0 0.52.0 -
golang.org/x/crypto PYSEC-2026-1758 medium Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin v0.14.0 - -
golang.org/x/crypto CVE-2026-39827 medium Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh v0.14.0 - -
golang.org/x/crypto GO-2023-2402 medium Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto v0.14.0 0.17.0 -
golang.org/x/crypto CVE-2023-48795 medium - v0.14.0 - -
golang.org/x/net CVE-2026-42506 medium Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.17.0 - -
golang.org/x/net GO-2026-5028 medium Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.17.0 0.55.0 -
golang.org/x/net CVE-2026-42502 medium Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.17.0 - -
golang.org/x/net CVE-2026-25680 medium Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.17.0 - -
golang.org/x/net GO-2026-5025 medium Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.17.0 0.55.0 -
golang.org/x/net GO-2026-5029 medium Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.17.0 0.55.0 -
golang.org/x/net GO-2026-5027 medium Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.17.0 0.55.0 -
golang.org/x/net CVE-2026-27136 medium Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.17.0 - -
golang.org/x/net GO-2026-5030 medium Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.17.0 0.55.0 -
golang.org/x/net CVE-2026-25681 medium Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.17.0 - -
github.com/Azure/azure-sdk-for-go/sdk/azidentity GHSA-m5vv-6r4h-3vj9 MODERATE Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability v1.2.0 1.6.0-beta.4.0.20240610221955-50774cd97099 -
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream GO-2026-5764 MODERATE DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9 1.7.8 -
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream GHSA-xmrv-pmrh-hhx2 MODERATE Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder v1.4.9 1.7.8 -
github.com/aws/aws-sdk-go-v2/service/lambda GHSA-xmrv-pmrh-hhx2 MODERATE Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder v1.25.0 1.88.5 -
github.com/aws/aws-sdk-go-v2/service/lambda GO-2026-5764 MODERATE DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.25.0 1.88.5 -
github.com/aws/aws-sdk-go-v2/service/s3 GHSA-xmrv-pmrh-hhx2 MODERATE Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder v1.29.3 1.97.3 -
github.com/aws/aws-sdk-go-v2/service/s3 GO-2026-5764 MODERATE DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.29.3 1.97.3 -
golang.org/x/crypto GHSA-9m57-25v3-79x9 MODERATE golang.org/x/crypto: Invoking pathological inputs can lead to client panic v0.14.0 0.52.0 -
golang.org/x/crypto GHSA-78mq-xcr3-xm33 MODERATE golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow v0.14.0 0.52.0 -
golang.org/x/crypto GO-2026-5014 MODERATE Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh v0.14.0 0.52.0 -
golang.org/x/crypto CVE-2026-39828 MODERATE Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh v0.14.0 - -
golang.org/x/crypto GO-2025-4135 MODERATE Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent v0.14.0 0.45.0 -
golang.org/x/crypto CVE-2025-47914 MODERATE Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent v0.14.0 - -
golang.org/x/crypto GHSA-f6x5-jh6r-wrfv MODERATE golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read v0.14.0 0.45.0 -
golang.org/x/crypto GHSA-45gg-vh54-h5m9 MODERATE golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions v0.14.0 0.52.0 -
golang.org/x/crypto GO-2025-4134 MODERATE Unbounded memory consumption in golang.org/x/crypto/ssh v0.14.0 0.45.0 -
golang.org/x/crypto CVE-2026-46598 MODERATE Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent v0.14.0 - -
golang.org/x/crypto GO-2026-5033 MODERATE Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent v0.14.0 0.52.0 -
golang.org/x/crypto CVE-2025-58181 MODERATE Unbounded memory consumption in golang.org/x/crypto/ssh v0.14.0 - -
golang.org/x/crypto GHSA-j5w8-q4qc-rx2x MODERATE golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption v0.14.0 0.45.0 -
golang.org/x/crypto GHSA-qpw4-5x99-6vjp MODERATE golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS v0.14.0 0.52.0 -
golang.org/x/crypto GHSA-45x7-px36-x8w8 MODERATE Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin v0.14.0 0.17.0 -
golang.org/x/crypto GO-2026-5015 MODERATE Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh v0.14.0 0.52.0 -
golang.org/x/crypto CVE-2026-39835 MODERATE Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh v0.14.0 - -
golang.org/x/net GHSA-w4gw-w5jq-g9jh MODERATE golang.org/x/net/html has a Quadratic Parsing Complexity issue v0.17.0 - -
golang.org/x/net GHSA-4v7x-pqxf-cx7m MODERATE net/http, x/net/http2: close connections when receiving too many headers v0.17.0 0.23.0 -
golang.org/x/net GO-2025-3595 MODERATE Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net v0.17.0 0.38.0 -
golang.org/x/net GHSA-5cv4-jp36-h3mw MODERATE Go Net HTML parser is vulnerable to denial of service v0.17.0 0.55.0 -
golang.org/x/net GHSA-vvgc-356p-c3xw MODERATE golang.org/x/net vulnerable to Cross-site Scripting v0.17.0 0.38.0 -
golang.org/x/net GO-2026-4440 MODERATE Quadratic parsing complexity in golang.org/x/net/html v0.17.0 0.45.0 -
golang.org/x/net GO-2025-3503 MODERATE HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net v0.17.0 0.36.0 -
golang.org/x/net GHSA-qxp5-gwg8-xv66 MODERATE HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net v0.17.0 0.36.0 -
golang.org/x/net GO-2024-2687 MODERATE HTTP/2 CONTINUATION flood in net/http v0.17.0 0.23.0 -
google.golang.org/protobuf GHSA-8r3f-844c-mc37 MODERATE Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON v1.31.0 1.33.0 -
github.com/golang-jwt/jwt/v4 GO-2024-3250 LOW Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt v4.4.2 4.5.1 -
github.com/golang-jwt/jwt/v4 CVE-2024-51744 LOW Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt v4.4.2 - -
github.com/golang-jwt/jwt/v4 GHSA-29wx-vh33-7x7r LOW Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations v4.4.2 4.5.1 -
golang.org/x/crypto GO-2026-5932 unknown The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues v0.14.0 - -
golang.org/x/net GO-2026-4441 unknown Infinite parsing loop in golang.org/x/net v0.17.0 0.45.0 -
golang.org/x/sys GO-2026-5024 unknown Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows v0.13.0 0.44.0 -
⚠️ Dependencies that have Reached EOL (9)
Dependency Unsafe Version EOL Date New Version Path Case
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.2.0 Nov 8, 2025 v1.14.0 go.mod -
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9 Oct 24, 2025 v1.7.14 go.mod -
github.com/aws/aws-sdk-go-v2/service/lambda v1.25.0 Nov 17, 2025 v1.99.0 go.mod -
github.com/aws/aws-sdk-go-v2/service/s3 v1.29.3 Nov 16, 2025 v1.105.2 go.mod -
github.com/golang-jwt/jwt/v4 v4.4.2 Jun 23, 2025 v4.5.2 go.mod -
github.com/sirupsen/logrus v1.9.0 Jul 19, 2025 v1.9.4 go.mod -
golang.org/x/oauth2 v0.10.0 Jul 5, 2026 v0.36.0 go.mod -
google.golang.org/grpc v1.55.0 May 4, 2026 v1.82.1 go.mod -
google.golang.org/protobuf v1.31.0 Jun 26, 2026 v1.36.11 go.mod -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-critical-severity adms-custom-action-failed adms-dependency-update adms-fixes-eol adms-go adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants