Repository navigation
build(deps): bump golang.org/x/crypto to v0.58.0, oras-go to v2.6.2 and Go to 1.26 - #1383
Open
AhmedElket92 wants to merge 2 commits into
Open
AhmedElket92 wants to merge 2 commits into
AhmedElket92 wants to merge 2 commits into
Conversation
golang.org/x/crypto v0.45.0 is affected by seven critical CVEs fixed in v0.52.0: CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508 and CVE-2026-46595. v0.58.0 also clears CVE-2026-56855 and CVE-2026-78662, which still affect v0.52.0 to v0.55.0. x/crypto v0.52.0 and later require Go 1.25, and v0.56.0 and later Go 1.26, so this also: - raises the go directive of the three modules to 1.26.0 - moves the CI, CodeQL and release workflows to Go 1.26 - bumps golangci-lint to v2.15.0 (v2.5.0 is built with Go 1.25 and refuses to load a module that targets Go 1.26) - updates the Go requirement in building.md Signed-off-by: AhmedElket92 <168613104+AhmedElket92@users.noreply.github.com>
AhmedElket92
requested review from
NiazFK,
gokarnm,
priteshbandi,
rgnote,
shizhMSFT,
toddysm,
vaninrao10 and
yizha1
as code owners
November 8, 2026 20:15
oras.land/oras-go/v2 v2.6.0 is affected by CVE-2026-50151, CVE-2026-50162, CVE-2026-50163, CVE-2026-85731, CVE-2026-85732, CVE-2026-48978 and GHSA-vh4v-2xq2-g5cg, all fixed in v2.6.2. golang.org/x/sync moves to v0.22.0 as a dependency of the new oras-go. Signed-off-by: AhmedElket92 <168613104+AhmedElket92@users.noreply.github.com>
AhmedElket92
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps
golang.org/x/cryptofrom v0.45.0 to v0.58.0 andoras.land/oras-go/v2from v2.6.0 to v2.6.2 in all three modules (root,test/e2e,test/e2e/plugin), together with the Go version x/crypto needs.Why
golang.org/x/cryptov0.45.0 is affected by seven critical CVEs, all fixed in v0.52.0:CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508, CVE-2026-46595.
v0.58.0 also clears CVE-2026-56855 and CVE-2026-78662, which still affect v0.52.0 to v0.55.0.
oras.land/oras-go/v2v2.6.0 is affected by CVE-2026-50151, CVE-2026-50162, CVE-2026-50163, CVE-2026-85731, CVE-2026-85732, CVE-2026-48978 and GHSA-vh4v-2xq2-g5cg, all fixed in v2.6.2 (golang.org/x/syncmoves to v0.22.0 with it).Dependabot's v0.52.0 bump (#1357) failed CI on Go 1.24 and was closed by the stale bot. x/crypto v0.52.0 and later require Go 1.25, and v0.56.0 and later Go 1.26, so this PR also:
godirective of the three modules to 1.26.0 (Go 1.24 and 1.25 are no longer supported upstream)the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.0)building.mdIt also covers the open dependabot PRs for the test modules (#1356, #1358, #1367). The same fix for a v1.3.3 patch release is in #1384 (against
release-1.3).Context: #1368 asks for a maintenance release. Downstream distributions such as Bottlerocket ship the notation CLI and are flagged for these CVEs until a release includes the fix.
Testing (Go 1.26.10, linux/amd64)
go build ./cmd/notation, thennotation versiongo test ./...: 22 packages pass (run without-race: no C compiler on the test machine)go vet ./...in all three modulesgolangci-lint runwith v2.15.0: 0 issuesgo mod verify: all modules verified