fix(deps): update module github.com/protonmail/go-crypto to v1.5.1
Metadata
Current evaluation
Renovate PR #650 merged into main, bumping github.com/ProtonMail/go-crypto v1.4.1 -> v1.5.1 in go.mod/go.sum (+3/-1), picking up upstream hardening for malformed OpenPGP input. Superseded later by #658 (v1.5.2).
Resolution: closed resolved
Reason: The PR itself was merged with 1 approval and all functional CI checks passing (unit-tests, snap-build/test, linters, sync, cla-check); it changed go.mod/go.sum to pin go-crypto v1.5.1. A later Renovate PR #658 bumped the dependency again to v1.5.2.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [github.com/ProtonMail/go-crypto](https://redirect.github.com/ProtonMail/go-crypto) | `v1.4.1` → `v1.5.1` |  |  |
---
### Release Notes
<details>
<summary>ProtonMail/go-crypto (github.com/ProtonMail/go-crypto)</summary>
### [`v1.5.1`](https://redirect.github.com/ProtonMail/go-crypto/releases/tag/v1.5.1)
[Compare Source](https://redirect.github.com/ProtonMail/go-crypto/compare/v1.5.0...v1.5.1)
#### What's Changed
- Harden handling of malformed OpenPGP input in [#​332](https://redirect.github.com/ProtonMail/go-crypto/pull/332)
- Ensure rsa key gen test works with go 1.27 in [#​334](https://redirect.github.com/ProtonMail/go-crypto/pull/334)
**Full Changelog**: <https://github.com/ProtonMail/go-crypto/compare/v1.5.0...v1.5.1>
### [`v1.5.0`](https://redirect.github.com/ProtonMail/go-crypto/releases/tag/v1.5.0)
[Compare Source](https://redirect.github.com/ProtonMail/go-crypto/compare/v1.4.1...v1.5.0)
#### What's Changed
- Implement ML-KEM, ML-DSA, and SLH-DSA in [#​316](https://redirect.github.com/ProtonMail/go-crypto/pull/316)
- Bump github.com/cloudflare/circl to 1.6.3 in [#​302](https://redirect.github.com/ProtonMail/go-crypto/pull/302)
- Ensure generated RSA key primes satisfy P < Q constraint in [#​305](https://redirect.github.com/ProtonMail/go-crypto/pull/305)
- Add `Signature.IssuerKeyVersion` field in [#​310](https://redirect.github.com/ProtonMail/go-crypto/pull/310)
- Fix RSA precompute after prime swap in [#​317](https://redirect.github.com/ProtonMail/go-crypto/pull/317)
- openpgp: prevent panic when candidate identity has no self-signature in [#​313](https://redirect.github.com/ProtonMail/go-crypto/pull/313)
- guard nil issuer key id when checking trailing signature in [#​320](https://redirect.github.com/ProtonMail/go-crypto/pull/320)
- guard nil issuer key id on v2 message read path in [#​319](https://redirect.github.com/ProtonMail/go-crypto/pull/319)
- Don't panic on unknown AEAD mode in v5/v6 SKESK packets in [#​322](https://redirect.github.com/ProtonMail/go-crypto/pull/322)
- restrict embedding to embeddable signature types in [#​325](https://redirect.github.com/ProtonMail/go-crypto/pull/325)
- fix: Malformed session key decoding in PKESK in [#​330](https://redirect.github.com/ProtonMail/go-crypto/pull/330)
- fix: Do not accept malformed ecdh sk input in [#​329](https://redirect.github.com/ProtonMail/go-crypto/pull/329)
- fix: Reduce risk of invalid slice access in [#​331](https://redirect.github.com/ProtonMail/go-crypto/pull/331)
**Full Changelog**: <https://github.com/ProtonMail/go-crypto/compare/v1.4.1...v1.5.0>
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/fetch-service).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Renovate PR #650 merged into main, bumping github.com/ProtonMail/go-crypto v1.4.1 -> v1.5.1 in go.mod/go.sum (+3/-1), picking up upstream hardening for malformed OpenPGP input. Superseded later by #658 (v1.5.2). | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #650 updated ProtonMail/go-crypto from v1.4.1 to v1.5.1, including hardening against malformed OpenPGP input; unit, snap, lint, and sync checks passed. | |
| qwen/qwen3.6-35b-a3b |
Impact:
55
Quick Win:
32
Complexity:
10
Confidence:
75
Actionability:
65
|
needs review | Renovate PR updating github.com/ProtonMail/go-crypto from v1.4.1 to v1.5.1. Includes security hardening for malformed OpenPGP input. CI: cla-check passing, OSV-scanner failing, other checks pending. |
Update history
| Date | Change |
|---|---|
| updated | |
| closed | |
| updated | |
| created |
Related work
-
Related To:
canonical/fetch-service#584
(confidence 90%)
Prior merged Renovate PR that set go-crypto to v1.4.1, the version this PR upgraded from.
-
Superseded By:
canonical/fetch-service#658
(confidence 85%)
Renovate PR #658 merged, bumping go-crypto v1.5.1 -> v1.5.2, superseding this version pin.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #584 fix(deps): update module github.com/protonmail/go-crypto to v1.4.1 | fetch-service | merged | Renovate PR merged, bumping github.com/ProtonMail/go-crypto from v1.4.0 to v1.4.1 (go.mod/go.sum) in commit 68bf1a2. Later superseded by v1.5.1 (#650) and v1.5.2 (#658). | |
| #658 fix(deps): update module github.com/protonmail/go-crypto to v1.5.2 | fetch-service | merged | Renovate PR #658 bumped github.com/ProtonMail/go-crypto from v1.5.1 to v1.5.2 (RSA key prime-ordering serialization fix) and was merged into main, updating go.mod/go.sum (+3/-1). | |
| #390 fix(deps): update module github.com/protonmail/go-crypto to v1.3.0 | fetch-service | merged | Renovate PR #390 merged, bumping github.com/ProtonMail/go-crypto v1.2.0 to v1.3.0 in commit 5c2348c. Later superseded by go-crypto v1.4.0/v1.4.1/v1.5.1/v1.5.2. | |
| #350 fix(deps): update module github.com/protonmail/go-crypto to v1.1.6 | fetch-service | merged | Renovate PR #350 bumped github.com/ProtonMail/go-crypto v1.1.5 -> v1.1.6 and was merged into main via commit de96aa0, updating go.mod and go.sum. | |
| #322 fix(deps): update module github.com/protonmail/go-crypto to v1.1.5 | fetch-service | closed | Renovate PR bumping ProtonMail/go-crypto v1.0.0 -> v1.1.5 was closed unmerged by maintainer cmatsuoka on 2025-02-23 as "Superseded by #348", which landed the same bump in commit 53e26a0. | |
| #578 fix(deps): update module github.com/protonmail/go-crypto to v1.4.0 | fetch-service | merged | Renovate PR merged as commit bf599c8, bumping github.com/ProtonMail/go-crypto v1.3.0 → v1.4.0 (also pulling cloudflare/circl v1.6.1 → v1.6.2). Later superseded by #584 (v1.4.1), #650 (v1.5.1) and #658 (v1.5.2). | |
| #286 fix(deps): update module github.com/protonmail/go-crypto to v1.1.3 | fetch-service | closed | Renovate PR to bump github.com/ProtonMail/go-crypto v1.0.0 -> v1.1.3 was approved but closed unmerged; Renovate ignored v1.1.3 and a later PR landed v1.1.5 instead. | |
| #379 fix(deps): update module github.com/protonmail/go-crypto to v1.2.0 | fetch-service | merged | Renovate dependency bump of github.com/ProtonMail/go-crypto v1.1.6 -> v1.2.0 (plus transitive circl v1.3.7 -> v1.6.0) was approved by two reviewers and merged into main in commit 7ad8f54, changing go.mod/go.sum. | |
| #348 build(deps): update go-crypto to v1.1.5 | fetch-service | merged | Merged PR #348 (commit 53e26a0) bumped github.com/ProtonMail/go-crypto to v1.1.5; shipped in fetch-service 0.7.0 (2025-04-08) as "fix(deps): update go-crypto to v1.1.5". | |
| #546 fix(deps): update module golang.org/x/crypto to v0.46.0 | fetch-service | merged | Renovate PR merged as commit 90bec85, bumping golang.org/x/crypto v0.45.0 -> v0.46.0 in go.mod/go.sum, with x/sys v0.38.0 -> v0.39.0 and x/text v0.31.0 -> v0.32.0 pulled in by go get. |