Repository navigation
fix(deps): bump golang.org/x/crypto to v0.52.0 to close OSV advisories - #3019
Conversation
Restores the OpenSSF Scorecard Vulnerabilities check to green. It regressed to 0/10 after #2852 because golang.org/x/crypto v0.51.0 accrued 13 new advisories (GO-2026-5005, 5006, 5013-5021, 5023, 5033). osv-scanner confirms all 13 trace to that one indirect package; v0.52.0 is the fixed version. go mod tidy changed only this line and its two go.sum hashes. After the bump osv-scanner reports no issues, both modules build, and 'make generate' produces no drift. Versions were changed with go get / go mod tidy, not by hand-editing the generated go.mod. Signed-off-by: Myasnikov Daniil <[email protected]> Assisted-By: Claude <[email protected]>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a security regression in the project's dependency tree by bumping the golang.org/x/crypto package. The update ensures that the project remains compliant with security standards by mitigating multiple known vulnerabilities, verified through automated scanning and build checks. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
github-actions
Bot
added
area/uncategorized
dosubot
Bot
added
security
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughUpdates the indirect dependency Changesgolang.org/x/crypto Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the golang.org/x/crypto dependency from version v0.51.0 to v0.52.0 in go.mod and go.sum. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Renovate skips indirect gomod deps by default, so transitive modules (golang.org/x/crypto, x/net, x/sys) that carry OSV advisories never get a PR — leaving the OpenSSF Scorecard Vulnerabilities check pinned at 0 even after #3019 bumped x/crypto in the root module only. - enable indirect gomod updates, grouped into one rolling PR - turn on osvVulnerabilityAlerts so vulnerable deps get dedicated, mergeable security PRs (labeled `security`, not `do-not-merge/hold`) Does not address GO-2025-3512 (kubevirt.io/csi-driver): no fixed version exists upstream and Renovate cannot resolve the module, so the Vulnerabilities check stays at 0 until that advisory is suppressed or patched separately. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Signed-off-by: Myasnikov Daniil <[email protected]>
## What Makes Renovate open the dependency PRs that close the OpenSSF Scorecard `Vulnerabilities` advisories, instead of doing them by hand (as in #3019). - Enable **indirect** gomod updates (grouped into one rolling "indirect go modules" PR). Renovate skips indirect Go deps by default, which is why `golang.org/x/crypto`, `x/net`, and `x/sys` — the transitive deps carrying the 20 OSV advisories — never got a PR. - Enable **`osvVulnerabilityAlerts`** so vulnerable deps get dedicated, mergeable security PRs (labeled `security`, not the global `do-not-merge/hold`). ## Why #3019 wasn't enough #3019 bumped `x/crypto` in the **root** module only. The repo has 5 `go.mod` modules; the same advisories live in `token-proxy` (x/crypto v0.50.0), `kubevirt-csi-driver`, and `kubeovn-webhook` (x/net / x/sys). The Scorecard `Vulnerabilities` check scans repo-wide and is all-or-nothing, so the count never dropped (still 0/10, 21 advisories). ## Known gap This does **not** fix `GO-2025-3512` (`kubevirt.io/csi-driver`): no fixed version exists upstream and Renovate can't even resolve the module (`no-result` in the Dependency Dashboard #2996). Until that one advisory is suppressed via `.osv-scanner.toml` or patched upstream, the Vulnerabilities check stays at 0/10. Tracked separately as a follow-up. ## Validation - `renovate-config-validator`: **Config validated successfully**. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added support for automated handling of vulnerability alerts. * Enabled updates for indirect Go module dependencies and grouped them together for easier review. * **Chores** * Updated automation settings to label security-related update pull requests appropriately. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 participants
What this PR does
Restores the OpenSSF Scorecard Vulnerabilities check to green. It regressed to 0/10 after #2852: in the weeks since,
golang.org/x/crypto v0.51.0accrued 13 new advisories (GO-2026-5005,5006,5013–5021,5023,5033). Anosv-scannerpass overmainconfirmed all 13 trace to that single package.Change
golang.org/x/crypto 0.51.0 → 0.52.0(the fixed version for all 13). No transitive cascade —go mod tidychanged only this line plus its twogo.sumhashes.Bumped with
go get/go mod tidy, not by hand-editing the generatedgo.mod.Verification
osv-scannerafter the bump: No issues found (0 advisories across both modules).go build ./...passes.make generateproduces no drift —codegen-driftstays green.Why this keeps happening (and the durable fix)
x/cryptois an indirect dependency, and the Renovate app isn't actually opening PRs on this repo yet (norenovate[bot]PRs, no Dependency Dashboard) — the org Renovate install needscozystack/cozystackadded to its repo list. Until then, indirect-dep and Go-toolchain advisories will keep knocking this check back to 0 and need manual bumps like this one. Recommended follow-ups: enable Renovate on the repo, and allow it to bump indirect deps (and optionally the Go patch version).Release note
Summary by CodeRabbit