Skip to content

Update golang.org/x/crypto to v0.52.0 - #170

Open
nishant111 wants to merge 1 commit into
sonic-net:masterfrom
nishant111:fix-x-crypto-cves-minimal
Open

nishant111 wants to merge 1 commit into
sonic-net:masterfrom
nishant111:fix-x-crypto-cves-minimal

Conversation

@nishant111

Copy link
Copy Markdown

Update x/crypto to fix security vulnerabilities reported in these CVE's :
CVE-2026-39830
CVE-2026-39831
CVE-2026-39832
CVE-2026-39833
CVE-2026-39834
CVE-2026-42508
CVE-2026-46596

Update the minimum companion version for x/net and x/sys modules as well as they are required by x/crypto
 x/crypto v0.52.0  explicitly requires:

•  x/net v0.54.0 
•  x/sys v0.45.0 
•  x/term v0.43.0 

Go’s minimum-version selection therefore upgrades these companion modules automatically.  x/text v0.39.0  already satisfies the required minimum, so it remains unchanged. The Go directive also remains at  1.25.9 . (raw.githubusercontent.com)

 go.sum  must change because it records integrity hashes for the selected module versions. Its changes cover only  x/crypto ,  x/net ,  x/sys , and transitive  x/term ; no unrelated modules changed.

Final minimal diff

x/crypto v0.50.0 -> v0.52.0
x/net v0.53.0 -> v0.54.0
x/sys v0.43.0 -> v0.45.0
x/term v0.42.0 -> v0.43.0 (go.sum only)

x/text remains v0.39.0
Go remains 1.25.9

Update the minimum companion x/net and x/sys modules required by x/crypto while preserving the existing Go and x/text versions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 877ef55e-5d69-4ebd-87c3-a5b5a94f3498
Signed-off-by: Nishant Sharma <nshntsharma86@gmail.com>
@nishant111 nishant111 self-assigned this Sep 25, 2026
@nishant111
nishant111 requested a lite review from Copilot September 25, 2026 00:38
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@mssonicbld

Copy link
Copy Markdown

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

No unresolved review issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

Updates Go cryptography dependencies to patched versions addressing the listed CVEs while retaining Go 1.25.9 and x/text v0.39.0.

Changes:

  • Upgrades x/crypto to v0.52.0.
  • Updates x/net, x/sys, and transitive x/term.
  • Refreshes corresponding go.sum checksums.
File Description
go.sum Refreshes dependency integrity hashes.
go.mod Updates crypto and companion module versions.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants