umputun / spot / 28689990513

84%

push

github

Bump golang.org/x/crypto and golang.org/x/net

Bumps golang.org/x/crypto v0.47.0 -> v0.53.0 and golang.org/x/net
v0.49.0 -> v0.56.0 (vendored). govulncheck reported 9 vulnerabilities on
live call paths, including an SSH panic (GO-2026-5013) and an ssh-agent
forwarding constraint bypass (GO-2026-5006) via the connector, and
HTTP/2 issues (GO-2026-4918, GO-2026-5026) via inventory loading over
HTTP; it is clean after the bump.

The new x/crypto agent.NewClient starts a background reader goroutine on
the agent connection, so the previously benign unclosed SSH_AUTH_SOCK
connections would now leak a goroutine in addition to the socket on
every agent-authenticated connection. The auth-time agent connection is
closed right after the SSH handshake, and the forwarding connection is
closed when the SSH client terminates; a failed forwarding setup closes
the client instead of leaking it. The dialed TCP connection is also
closed on the sshConfig error path, which previously leaked it (the
NewClientConn path closes it itself on handshake failure).

8 of 27 new or added lines in 1 file covered. (29.63%)

3127 of 3730 relevant lines covered (83.83%)

58.36 hits per line