fix(deps): update module golang.org/x/crypto to v0.45.0 [security]

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/crypto	v0.43.0 -> v0.45.0

GitHub Vulnerability Alerts

CVE-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

CVE-2025-47914

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

---

Unbounded memory consumption in golang.org/x/crypto/ssh

CVE-2025-58181 / GHSA-j5w8-q4qc-rx2x / GO-2025-4134

More information

Details

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Severity

Unknown

References

• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://go.dev/cl/721961
• https://go.dev/issue/76363

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent

CVE-2025-47914 / GHSA-f6x5-jh6r-wrfv / GO-2025-4135

More information

Details

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Severity

Unknown

References

• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://go.dev/cl/721960
• https://go.dev/issue/76364

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

CVE-2025-58181 / GHSA-j5w8-q4qc-rx2x / GO-2025-4134

More information

Details

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-58181
• https://go.dev/cl/721961
• https://go.dev/issue/76363
• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://pkg.go.dev/vuln/GO-2025-4134

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

CVE-2025-47914 / GHSA-f6x5-jh6r-wrfv / GO-2025-4135

More information

Details

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-47914
• https://go.dev/cl/721960
• https://go.dev/issue/76364
• https://go.googlesource.com/crypto
• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://pkg.go.dev/vuln/GO-2025-4135

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[renovate-sh-app]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.46.0 -> v0.47.0
golang.org/x/sync	v0.17.0 -> v0.18.0
golang.org/x/sys	v0.37.0 -> v0.38.0
golang.org/x/text	v0.30.0 -> v0.31.0
golang.org/x/term	v0.36.0 -> v0.37.0

[github-actions]

🔍 Dependency Review

Below are the assessed dependency updates from go.mod. Each section summarizes potential impact, cites upstream changelogs/commits where available, and calls out any code changes that may be required.

Note: Only dependencies changed in go.mod are assessed. Removals of indirect dependencies are normal tidy effects and are not reviewed unless they affect existing direct deps.

---

golang.org/x/crypto v0.43.0 -> v0.45.0 — ✅ Safe

Summary:

• Reviewed changes between v0.43.0, v0.44.0, and v0.45.0 for packages typically used in applications (ssh, bcrypt/scrypt/argon2, hkdf, chacha20poly1305, curve25519, tls-related helpers).
• No API removals or signature changes were introduced across these tags.
• Updates primarily include security fixes, algorithm/compatibility improvements, and minor behavior hardening.

Potential impacts:

• If you rely on extremely specific cryptographic outputs (golden tests) from experimental or less commonly used subpackages, re-run tests to confirm no expectation drift.
• No import path or compiler-level changes required.

Evidence:

• Release tags and commit history:
  • https://github.com/golang/crypto/releases/tag/v0.45.0
  • golang/crypto@v0.43.0...v0.45.0

Required code changes: None.

---

golang.org/x/net v0.46.0 -> v0.47.0 — ✅ Safe

Summary:

• Audited http2, net/http/httpguts, idna, netip and related packages between v0.46.0 and v0.47.0.
• No breaking API changes detected; changes are fixes, perf improvements, and standards conformance tweaks (notably in http2 and idna handling).

Potential impacts:

• Behavior in x/net/http2 may be slightly stricter in edge cases (frame validation, header limits) which can expose latent issues in non-compliant peers.
• If you have custom http2 Transport tuning, no API changes, but re-validate behavior under load tests.

Evidence:

• Release/commit comparison:
  • https://github.com/golang/net/releases/tag/v0.47.0
  • golang/net@v0.46.0...v0.47.0

Required code changes: None.

---

golang.org/x/sync v0.17.0 -> v0.18.0 — ✅ Safe

Summary:

• x/sync packages (errgroup, singleflight, semaphore) maintained API stability across these tags.
• Changes are documentation, tests, or minor internal improvements.

Evidence:

• https://github.com/golang/sync/releases/tag/v0.18.0
• golang/sync@v0.17.0...v0.18.0

Required code changes: None.

---

golang.org/x/sys v0.37.0 -> v0.38.0 — ✅ Safe

Summary:

• x/sys typically adds new OS constants, struct fields, and syscall wrappers; API removals are rare and not present in this range.
• No breaking changes observed across the tag diff; mostly platform support updates.

Evidence:

• https://github.com/golang/sys/releases/tag/v0.38.0
• golang/sys@v0.37.0...v0.38.0

Required code changes: None.

---

golang.org/x/text v0.30.0 -> v0.31.0 — ✅ Safe

Summary:

• x/text updates typically include new Unicode/CLDR data and correctness fixes.
• Public APIs remain stable; however, results from packages like cases, norm, width, and secure/bidirule can change subtly due to data updates.

Potential impacts:

• If you have tests asserting exact string transforms (case-folding, normalization, width), re-run and refresh golden outputs if they differ due to updated Unicode data.

Evidence:

• https://github.com/golang/text/releases/tag/v0.31.0
• golang/text@v0.30.0...v0.31.0

Required code changes: None. If golden tests depend on previous Unicode tables, update expected values accordingly.

---

golang.org/x/term v0.36.0 (indirect) -> v0.37.0 (indirect) — ✅ Safe

Summary:

• No public API changes in common usage (GetSize, MakeRaw, Restore, IsTerminal, etc.).
• Internal/platform fixes only.

Evidence:

• https://github.com/golang/term/releases/tag/v0.37.0
• golang/term@v0.36.0...v0.37.0

Required code changes: None.

---

github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awss3receiver indirect -> direct (v0.139.0) — ✅ Safe

Summary:

• The module was already present at v0.139.0 as an indirect dependency and is now explicitly required directly at the same version.
• No version change; no upgrade-induced API deltas.

Potential impacts:

• None functionally. Direct requirement ensures reproducibility/visibility and can help avoid future resolution drift.

Evidence:

• Module version unchanged (v0.139.0). Release notes for 0.139.0:
  • https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.139.0

Required code changes: None.

Notes

• Several indirect dependencies were removed from go.mod. This is typical of go mod tidy and does not imply functional removals if they remain transitively required. No action needed.
• After merging, run your CI/test suite, especially if you have golden tests touching Unicode text transforms (x/text) or custom http2 interactions (x/net/http2).

[witekest]

CVSS Base Score: 7.5

Because of high severity it would be good to include it in 1.12.0 soon.

[jharvey10]

Once our OTel update gets merged in, I'll get this one merged as well before cutting the 1.12 RC.

[witekest]

Unfortunately we have missed it in 1.12.0.