20 module-level govulncheck advisories against x/crypto v0.37.0 drop to 1 (upstream-unfixed GO-2026-5932); not reachable from our code, cleared by routine bump. go build + go test green. Dev gitlink pin follows.
20 module-level govulncheck advisories against x/crypto v0.37.0 drop to 1 (upstream-unfixed GO-2026-5932); not reachable from our code, cleared by routine bump. go build + go test green. Dev gitlink pin follows.
Why: govulncheck reported 20 module-level advisories against golang.org/x/crypto v0.37.0 (19 with upstream fixes, GO-2026-5932 unfixed); none were reachable from our code, but the whole batch clears with one routine bump — follow-up to the 2026-09-30 dependency CVE inventory.
Evidence: golang.org/x/crypto v0.37.0 => v0.56.0 (x/text follows to v0.41.0 as a requirement); CGO_ENABLED=0 go build ./... and go test -count=1 ./... green against the new core types; govulncheck now reports 0 affected, 0 import-level, 1 module-level (the upstream-unfixed GO-2026-5932 — the floor until upstream ships a fix).
Impact: go.mod/go.sum bumps only; no code change; x/crypto is not imported by any of our packages (transitive require).
Refs: Dev-side task fix/followup-hardening (gitlink pin follows after combined verification)
weichen
merged commit daddac8e47 into main2026-09-30 17:15:33 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
20 module-level govulncheck advisories against x/crypto v0.37.0 drop to 1 (upstream-unfixed GO-2026-5932); not reachable from our code, cleared by routine bump. go build + go test green. Dev gitlink pin follows.