Bump golang.org/x/crypto past CVE-2026-56854 - #667
Conversation
Trivy has been red on main since af381b3: CVE-2026-56854 in the indirect golang.org/x/crypto v0.54.0, fixed in v0.55.0. Bump it and recompute the nix vendorHash.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
Pull request overview
Updates the indirect golang.org/x/crypto dependency to the release fixing CVE-2026-56854.
Changes:
- Bumps
x/cryptofrom v0.54.0 to v0.55.0. - Refreshes module checksums and the Nix vendor hash.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
go.mod |
Updates the indirect dependency version. |
go.sum |
Updates checksums for v0.55.0. |
nix/package.nix |
Refreshes the Nix vendor hash. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The Trivy Security Scan check has been red on main since
af381b34(before #665/#666): CVE-2026-56854 in the indirectgolang.org/x/cryptov0.54.0, fixed upstream in v0.55.0. Both open PRs' reviewers flagged the unexplained red check; this bump owns it.go get golang.org/x/crypto@v0.55.0 && go mod tidy, plus the nix vendorHash recompute. No direct-dependency or code changes.Summary by cubic
Bumps the indirect
golang.org/x/cryptofrom v0.54.0 to v0.55.0 to resolve CVE-2026-56854, which has been failing the Trivy security scan on main.No behavior changes; the dependency is indirect and the nix vendor hash is recomputed to match.
Written for commit 8e28ef8. Summary will update on new commits.