fix(deps): update module golang.org/x/crypto to v0.45.0 [security]
Metadata
Current evaluation
Renovate security bump of golang.org/x/crypto v0.43.0 -> v0.45.0 merged into main via commit ead7f12, fixing CVE-2025-58181 (SSH GSSAPI unbounded memory) and CVE-2025-47914 (SSH agent out-of-bounds read).
Resolution: closed resolved
Reason: PR #526 was approved by two reviewers with all CI checks green and merged into main as commit ead7f12 ("fix(deps): update module golang.org/x/crypto to v0.45.0 [security] (#526)"), which also pulled x/net v0.47.0, x/sys v0.38.0 and x/text v0.31.0. Later Renovate bumps (#546, #610, #617, #632) took the dependency to v0.54.0/v0.55.0.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| golang.org/x/crypto | `v0.43.0` -> `v0.45.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2025-58181](https://nvd.nist.gov/vuln/detail/CVE-2025-58181)
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
#### [CVE-2025-47914](https://nvd.nist.gov/vuln/detail/CVE-2025-47914)
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/fetch-service).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4xNi4xIiwidXBkYXRlZEluVmVyIjoiNDIuMTYuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate security bump of golang.org/x/crypto v0.43.0 -> v0.45.0 merged into main via commit ead7f12, fixing CVE-2025-58181 (SSH GSSAPI unbounded memory) and CVE-2025-47914 (SSH agent out-of-bounds read). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #526 (commit ead7f12), updating golang.org/x/crypto from v0.43.0 to v0.45.0 to address CVE-2025-58181 and CVE-2025-47914. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged security update upgrading golang.org/x/crypto to v0.45.0 to address CVE-2025-58181 and CVE-2025-47914. Approved by two reviewers, passed CI, and merged alongside updates to golang.org/x/net, golang.org/x/sys, and golang.org/x/text. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
canonical/fetch-service#546
(confidence 70%)
Follow-up Renovate bump of golang.org/x/crypto to v0.46.0 (commit 90bec85) supersedes this version.
-
Related To:
canonical/fetch-service#453
(confidence 50%)
Prior v0.43.0 bump (commit 07296f4) that this PR upgraded from.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #453 fix(deps): update module golang.org/x/crypto to v0.43.0 | fetch-service | merged | Renovate PR #453 bumping golang.org/x/crypto v0.42.0 -> v0.43.0 (plus x/sys v0.37.0, x/text v0.30.0) was approved and merged into main as commit 07296f4. | |
| #468 fix(deps): update module golang.org/x/net to v0.45.0 | fetch-service | merged | Renovate dependency bump of golang.org/x/net v0.43.0 -> v0.45.0 merged to main via commit 957f5d6 (go.mod/go.sum, +12/-4), also pulling x/crypto v0.42.0, x/sys v0.36.0, x/text v0.29.0. | |
| #546 fix(deps): update module golang.org/x/crypto to v0.46.0 | fetch-service | merged | Renovate PR merged as commit 90bec85, bumping golang.org/x/crypto v0.45.0 -> v0.46.0 in go.mod/go.sum, with x/sys v0.38.0 -> v0.39.0 and x/text v0.31.0 -> v0.32.0 pulled in by go get. | |
| #435 fix(deps): update module golang.org/x/crypto to v0.41.0 - autoclosed | fetch-service | closed | Renovate update #435 was autoclosed unmerged; x/crypto was later advanced to v0.43.0 by merged PR #453 (commit 07296f4). | |
| #405 fix(deps): update module golang.org/x/crypto to v0.40.0 | fetch-service | merged | Renovate PR #405 merged into main via commit b1022d8, bumping golang.org/x/crypto v0.36.0 -> v0.40.0 plus x/net, x/sys, x/text. Approved by 2 reviewers, all CI checks green. | |
| #436 fix(deps): update module golang.org/x/net to v0.43.0 | fetch-service | merged | Renovate bump of golang.org/x/net v0.42.0 -> v0.43.0 merged as commit 2f3bc76, also pulling transitive x/crypto v0.41.0, x/sys v0.35.0 and x/text v0.28.0. Later superseded by v0.45.0 (#468) and further bumps. | |
| #555 fix(deps): update module golang.org/x/crypto to v0.47.0 | fetch-service | closed | Closed unmerged after the sync check failed; Renovate ignored v0.47.0 pending a newer release, and later dependency updates superseded it. | |
| #505 fix(deps): update module golang.org/x/crypto to v0.44.0 - abandoned | fetch-service | closed | Renovate's x/crypto v0.43.0->v0.44.0 bump (#505) was closed unmerged after the branch was hand-edited (CI linters/snap-tests red); x/crypto later advanced via #526 (v0.45.0, security). | |
| #617 fix(deps): update module golang.org/x/crypto to v0.53.0 | fetch-service | merged | Renovate PR #617 merged to main as commit 24ce0e5, bumping golang.org/x/crypto v0.52.0 to v0.53.0 (plus x/sys v0.46.0 and x/text v0.38.0) after 1 approval. | |
| #632 fix(deps): update module golang.org/x/crypto to v0.54.0 | fetch-service | merged | Renovate PR #632 merged to main as commit 0808b7d, bumping golang.org/x/crypto v0.53.0 to v0.54.0, plus x/net to v0.56.0 and x/text to v0.40.0. |