Skip to content

chore(deps): update Go module dependencies for CVE security#1402

Merged
TwiN merged 1 commit intoTwiN:masterfrom
appleboy:sec
Nov 27, 2025
Merged

chore(deps): update Go module dependencies for CVE security#1402
TwiN merged 1 commit intoTwiN:masterfrom
appleboy:sec

Conversation

@appleboy
Copy link
Contributor

  • Update golang.org/x/crypto, golang.org/x/net, and golang.org/x/sync dependencies to newer versions
  • Bump indirect dependencies golang.org/x/mod, golang.org/x/sys, golang.org/x/text, and golang.org/x/tools to latest releases

Scan result from docker image twinproduction/gatus:v5.33.0

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2025-47914 │ MEDIUM   │ fixed  │ v0.43.0           │ 0.45.0        │ SSH Agent servers do not validate the size of messages when │
│                     │                │          │        │                   │               │ processing...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-47914                  │
│                     ├────────────────┤          │        │                   │               ├─────────────────────────────────────────────────────────────┤
│                     │ CVE-2025-58181 │          │        │                   │               │ SSH servers parsing GSSAPI authentication requests do not   │
│                     │                │          │        │                   │               │ validate the ...                                            │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-58181                  │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

- Update golang.org/x/crypto, golang.org/x/net, and golang.org/x/sync dependencies to newer versions
- Bump indirect dependencies golang.org/x/mod, golang.org/x/sys, golang.org/x/text, and golang.org/x/tools to latest releases

* CVE-2025-47914 and CVE-2025-58181

Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
@github-actions github-actions bot added the area/security Related to security label Nov 27, 2025
@TwiN TwiN changed the title chore(mod): update Go module dependencies for CVE security chore(deps): update Go module dependencies for CVE security Nov 27, 2025
@TwiN TwiN added the dependencies Pull requests that update a dependency file label Nov 27, 2025
@TwiN TwiN merged commit 86cd1a9 into TwiN:master Nov 27, 2025
3 checks passed
@TwiN
Copy link
Owner

TwiN commented Nov 27, 2025

Thanks for the contribution!

@appleboy appleboy deleted the sec branch November 28, 2025 01:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/security Related to security dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants