build(deps): bump x/crypto to 0.55.0 - #346
Conversation
![redpandabot[bot]](https://avatars.githubusercontent.com/in/3749543?s=60&v=4){kind=small}
There was a problem hiding this comment.
Bumps golang.org/x/crypto from 0.54.0 to 0.55.0 along with the tidy-selected x/text 0.41.0, x/mod 0.38.0, x/tools 0.48.0, and x/telemetry updates. OSV confirms the bump is a strict improvement (removes GO-2026-6303; the only remaining advisory GO-2026-5932 is version-independent and equally present at 0.54.0), the transitive versions match x/crypto 0.55.0's own go.mod, and the diff is minimal version-only churn. Clean.
Reviewed 2 changed file(s) @ 8c6ef708 — no blocking issues found.
"Cheaper to fly to Vietnam than to fix it here."
🐼 Smoke eval —
|
| question | result | tokens | tools |
|---|---|---|---|
forky_node_coverage |
✅ | 84,808 | 7 |
tracoor_node_coverage |
✅ | 103,971 | 8 |
mainnet_block_arrival_p50 |
✅ | 104,927 | 7 |
list_datasources |
✅ | 36,747 | 2 |
block_count_24h |
✅ | 155,519 | 13 |
missed_slots_24h |
✅ | 355,642 | 29 |
chartkit_default_arrival_distribution |
✅ | 598,444 | 34 |
storage_upload_session_scoped |
✅ | 116,064 | 7 |
evm_faucet_fund_throwaway_address |
✅ | 73,678 | 8 |
🔭 Langfuse traces (9 runs; ⚠️ = failed)
The report walks this branch's commits against the master baseline and the most recent release. A self-contained copy is in the run's eval-smoke-* artifact.
1 participant
Summary
golang.org/x/cryptofrom 0.54.0 to 0.55.0x/text,x/tools,x/mod, andx/telemetryversions selected bygo mod tidyReachability
Panda imports
x/crypto/argon2;go list -deps ./...does not includegolang.org/x/crypto/ssh. The vulnerable SSH path is therefore not reachable in shipped code, but updating removes the affected module version from the graph.Verification
make testgo tool govulncheck ./...go mod tidy && git diff --exit-code go.mod go.sum