fix(deps): update module golang.org/x/crypto to v0.45.0 [security]

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/crypto	v0.43.0 -> v0.45.0

GitHub Vulnerability Alerts

CVE-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

CVE-2025-47914

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

---

golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

CVE-2025-47914 / GHSA-f6x5-jh6r-wrfv / GO-2025-4135

More information

Details

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-47914
• https://go.dev/cl/721960
• https://go.dev/issue/76364
• https://go.googlesource.com/crypto
• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://pkg.go.dev/vuln/GO-2025-4135

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent

CVE-2025-47914 / GHSA-f6x5-jh6r-wrfv / GO-2025-4135

More information

Details

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Severity

Unknown

References

• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://go.dev/cl/721960
• https://go.dev/issue/76364

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Unbounded memory consumption in golang.org/x/crypto/ssh

CVE-2025-58181 / GHSA-j5w8-q4qc-rx2x / GO-2025-4134

More information

Details

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Severity

Unknown

References

• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://go.dev/cl/721961
• https://go.dev/issue/76363

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

CVE-2025-58181 / GHSA-j5w8-q4qc-rx2x / GO-2025-4134

More information

Details

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-58181
• https://go.dev/cl/721961
• https://go.dev/issue/76363
• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://pkg.go.dev/vuln/GO-2025-4134

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[renovate-sh-app]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.46.0 -> v0.47.0
golang.org/x/sync	v0.17.0 -> v0.18.0
golang.org/x/sys	v0.37.0 -> v0.38.0
golang.org/x/text	v0.30.0 -> v0.31.0
golang.org/x/term	v0.36.0 -> v0.37.0

[github-actions]

🔍 Dependency Review

Below is an assessment of the Go module dependency updates in this PR, with links to release notes and any actionable code-change guidance.

---

golang.org/x/crypto v0.43.0 -> v0.45.0 — ✅ Safe

• Reviewed releases:
  • v0.44.0: https://github.com/golang/crypto/releases/tag/v0.44.0
  • v0.45.0: https://github.com/golang/crypto/releases/tag/v0.45.0

Summary:

• No documented exported API removals or breaking changes across v0.44.0 and v0.45.0.
• Changes in these ranges are primarily bug fixes and security hardening across subpackages (e.g., ssh, hkdf, tls primitives).

Potential areas to smoke-test:

• Code paths using x/crypto/ssh authentication and key parsing.
• Any custom crypto primitives usage (scrypt, hkdf) for behavior changes under edge conditions.

Code changes required:

• None expected.

---

golang.org/x/net v0.46.0 -> v0.47.0 — ✅ Safe

• Reviewed releases:
  • v0.47.0: https://github.com/golang/net/releases/tag/v0.47.0

Summary:

• No documented exported API removals or behavioral breaking changes.
• Typical updates include bug fixes across subpackages (http2, proxy, websocket, net{ipv4,ipv6}, etc.).

Potential areas to smoke-test:

• HTTP/2 clients/servers using x/net/http2 (timeouts, flow control, connection reuse).
• Proxy and websocket integrations.

Code changes required:

• None expected.

---

golang.org/x/sync v0.17.0 -> v0.18.0 — ✅ Safe

• Reviewed releases:
  • v0.18.0: https://github.com/golang/sync/releases/tag/v0.18.0

Summary:

• No API removals; errgroup, singleflight, semaphore maintain compatibility.
• Minor fixes and documentation improvements.

Potential areas to smoke-test:

• Errgroup cancellation semantics when the first error is returned.
• Semaphore acquisition/release under contention.

Code changes required:

• None expected.

---

golang.org/x/sys v0.37.0 -> v0.38.0 — ✅ Safe

• Reviewed releases:
  • v0.38.0: https://github.com/golang/sys/releases/tag/v0.38.0

Summary:

• Additions of new constants/structs and platform updates; no removals observed.
• This package rarely introduces breaking changes in minor bumps.

Potential areas to smoke-test:

• Platform-specific code paths (epoll/kqueue/ioctl/termios).
• Filesystem/permissions and signal handling on Linux/BSD/Darwin/Windows.

Code changes required:

• None expected.

---

golang.org/x/text v0.30.0 -> v0.31.0 — ✅ Safe

• Reviewed releases:
  • v0.31.0: https://github.com/golang/text/releases/tag/v0.31.0

Summary:

• Data/table updates (e.g., Unicode/CLDR refresh), no API removals indicated.
• Security and correctness improvements in bidi/cases/runes packages are typical.

Potential areas to smoke-test:

• Any bidi-sensitive rendering paths.
• Case folding/normalization-sensitive logic.

Code changes required:

• None expected.

---

golang.org/x/term v0.36.0 -> v0.37.0 (indirect) — ✅ Safe

• Reviewed releases:
  • v0.37.0: https://github.com/golang/term/releases/tag/v0.37.0

Summary:

• No API changes indicated; maintenance and platform constant updates.
• Indirect dependency bump; validate only if you directly call term functions.

Code changes required:

• None expected.

Notes

• All updates are minor bumps within v0 modules from golang.org/x. Based on the release notes referenced above, no code changes are indicated.
• Recommended to run existing integration tests that exercise:
  • x/net/http2 client/server flows
  • SSH auth/handshake using x/crypto/ssh
  • Terminal and syscalls on supported platforms
• No net-new dependencies were introduced by the provided diff.

[witekest]

CVSS Base Score: 7.5

Because of high severity it would be good to include it in 1.12.0 soon.

[jharvey10]

Once our OTel update gets merged in, I'll get this one merged as well before cutting the 1.12 RC.