Skip to content

chore(all): update module golang.org/x/crypto to v0.45.0 [SECURITY] #13634

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
shollyman merged 1 commit into from
Jan 16, 2026
Merged

chore(all): update module golang.org/x/crypto to v0.45.0 [SECURITY] #13634

shollyman merged 1 commit into from
Jan 16, 2026

Conversation

@renovate-bot
Copy link
Contributor

@renovate-bot renovate-bot commented Jan 16, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
golang.org/x/crypto v0.43.0 → v0.45.0 age confidence

GitHub Vulnerability Alerts

CVE-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@forking-renovate
Copy link

forking-renovate bot commented Jan 16, 2026

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: grafeas/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: gsuiteaddons/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: iam/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: iap/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: identitytoolkit/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: ids/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: iot/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: kms/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: language/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: licensemanager/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: lifesciences/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: locationfinder/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: logging/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: longrunning/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: lustre/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: maintenance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: managedidentities/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: managedkafka/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: maps/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: mediatranslation/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: memcache/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: memorystore/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: metastore/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: migrationcenter/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: modelarmor/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: monitoring/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: netapp/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: networkconnectivity/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: networkmanagement/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: networksecurity/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: networkservices/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: notebooks/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: oracledatabase/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: orgpolicy/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: pubsub/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: recaptchaenterprise/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: recommendationengine/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: recommender/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: redis/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: resourcemanager/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0
File name: retail/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
golang.org/x/net v0.46.0 -> v0.47.0
golang.org/x/sys v0.37.0 -> v0.38.0
golang.org/x/text v0.30.0 -> v0.31.0

@renovate-bot renovate-bot requested review from a team as code owners January 16, 2026 22:27
@trusted-contributions-gcf trusted-contributions-gcf bot added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jan 16, 2026
@kokoro-team kokoro-team removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jan 16, 2026
@gemini-code-assist
Copy link
Contributor

gemini-code-assist bot commented Jan 16, 2026

Summary of Changes

Hello @renovate-bot, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on enhancing the project's security posture by updating key Go language dependencies. The primary driver is a critical security patch for the golang.org/x/crypto module, which resolves known vulnerabilities in SSH handling. This ensures the codebase benefits from the latest security fixes and dependency improvements.

Highlights

  • Security Update: Updated the golang.org/x/crypto module from v0.43.0 to v0.45.0 to address two critical security vulnerabilities (CVE-2025-58181 and CVE-2025-47914) related to SSH servers and agents.
  • Dependency Updates: Other core golang.org/x modules, including golang.org/x/net, golang.org/x/sys, and golang.org/x/text, have also been updated to their latest versions.
  • Scope of Changes: These dependency updates are applied consistently across the main go.mod and go.sum files, as well as within all sub-modules of the repository.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist[bot]
gemini-code-assist bot reviewed Jan 16, 2026
View reviewed changes
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the golang.org/x/crypto dependency from v0.43.0 to v0.45.0 across all Go modules in the repository. This is an important security update that addresses vulnerabilities in the SSH server's GSSAPI authentication request parsing and the SSH Agent server's identity request processing. The changes also include updates to transitive dependencies like golang.org/x/net, golang.org/x/sys, and golang.org/x/text. The modifications are correctly confined to go.mod and go.sum files. The update appears correct and is recommended for merging to improve the security posture of the project.

@shollyman shollyman mentioned this pull request Jan 16, 2026
Closed
@shollyman shollyman added the automerge Merge the pull request once unit tests and other checks pass. label Jan 16, 2026
@shollyman
Copy link
Contributor

shollyman commented Jan 16, 2026

vet's complaining about test module info, I'm going to merge this PR as is and resolve via followup.

@shollyman shollyman merged commit 198c8c6 into googleapis:main Jan 16, 2026
11 of 12 checks passed
@gcf-merge-on-green gcf-merge-on-green bot removed the automerge Merge the pull request once unit tests and other checks pass. label Jan 16, 2026
krishnamd-jkp pushed a commit that referenced this pull request Jan 28, 2026
@renovate-bot @krishnamd-jkp
chore(all): update module golang.org/x/crypto to v0.45.0 [SECURITY] (#…
ab992c3 
…13634)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) |
[`v0.43.0` →
`v0.45.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.43.0...refs/tags/v0.45.0)
|
![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fcrypto/v0.45.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fcrypto/v0.43.0/v0.45.0?slim=true)
|

### GitHub Vulnerability Alerts

#### [CVE-2025-58181](https://nvd.nist.gov/vuln/detail/CVE-2025-58181)

SSH servers parsing GSSAPI authentication requests do not validate the
number of mechanisms specified in the request, allowing an attacker to
cause unbounded memory consumption.

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/googleapis/google-cloud-go).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi43NC41IiwidXBkYXRlZEluVmVyIjoiNDIuNzQuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shollyman shollyman shollyman approved these changes

+1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@renovate-bot @shollyman @kokoro-team