33755077669
70%

Ran 03 Sep 2026 12:33PM UTC

Jobs 1

Files 905

Run time 2min

Badge

Embed ▾

Committed 03 Sep 2026 12:24PM UTC coverage: 69.844% (-0.005%) from 69.849%

Build # 33755077669

Build Type

push

github

Committed by

web-flow

Commit Message

Bump x/crypto to v0.56.0 and adopt go 1.26.0 (#6494)

Two advisories were published against golang.org/x/crypto/ssh —
GO-2026-6354 and GO-2026-6355, both channel-deadlock DoS bugs a malicious
SSH peer can trigger — failing the govulncheck gate on every PR and on
main's next scheduled scan.

These are production-reachable, not test-only: govulncheck traces the
vulnerable ssh.NewClientConn from pkg/git.Clone -> go-git CloneContext ->
go-git's SSH transport (registered by default), i.e. any clone over SSH.
So x/crypto/ssh cannot simply be dropped — it backs go-git's SSH support.

The fix is x/crypto v0.56.0, but that release declares `go 1.26.0` in its
own go.mod, so any consumer must also declare `go 1.26.0`. That collides
with lint.yml's "go.mod must pin Go to minor version" check, which is why
every go step in CI rewrote the directive to a patch version and lint then
rejected it. The two cannot both hold, so this adopts the patch directive:

- Bump golang.org/x/crypto v0.55.0 -> v0.56.0
- Set the go directive to go 1.26.0 (required transitively by x/crypto)
- Remove lint.yml's minor-version go.mod check, which the new floor
  makes untenable

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Coverage Stats

77244 of 110595 relevant lines covered (69.84%)

91.81 hits per line

Coverage Regressions

Lines	Coverage	∆	File
4	59.0	-0.42%	pkg/workloads/manager.go
3	96.18	-0.57%	pkg/authz/authorizers/cedar/core.go
3	61.43	-4.29%	pkg/state/runconfig.go
2	50.66	-0.53%	pkg/transport/stdio.go
1	94.96	0.0%	pkg/authserver/storage/memory.go
1	81.07	-0.12%	pkg/vmcp/composer/workflow_engine.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	33755077669.1	03 Sep 2026 12:33PM UTC	905	69.84	GitHub Action Run

stacklok / toolhive / 33755077669
70%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 33755077669

stacklok / toolhive / 33755077669 70%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 33755077669

stacklok / toolhive / 33755077669
70%

README BADGES
x