You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Update module golang.org/x/crypto to v0.59.0 [SECURITY] (main) - #3694
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
This updates golang.org/x dependencies as a security update. No concrete merge-blocking defect was found. The legacy OpenPGP package remains an indirect dependency of the cosign and rekor chain, so it is worth watching upstream, but it does not block this update.
Pre-merge checks: 3 · 1
Failed checks: 1 inconclusive
Check name
Status
Explanation
Resolution
Description check
The description follows the Renovate-generated format. It gives the package, version change, and a vulnerability advisory (GO-2026-5932) about golang.org/x/crypto/openpgp, with a suggested maintained …
Add the repository template sections: a What section that states the change (bump golang.org/x/crypto v0.57.0 to v0.59.0 and the related indirect updates), a Why section that explains the security need (GO-2026-5932, openpgp package), and a…
Passed checks: 3 passed
Check name
Status
Explanation
Title check
The title names the main change: updating golang.org/x/crypto from v0.57.0 to v0.59.0 in the Go modules. The changeset updates that dependency in go.mod, acceptance/go.mod, and tools/go.mod, so the ti…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the main change: updating golang.org/x/crypto from v0.57.0 to v0.59.0 in the Go modules. The changeset updates that dependency in go.mod, acceptance/go.mod, and tools/go.mod, so the title matches the primary change. It also flags the security nature of the update, which the PR metadata supports.
Full details: Description check
Explanation
The description follows the Renovate-generated format. It gives the package, version change, and a vulnerability advisory (GO-2026-5932) about golang.org/x/crypto/openpgp, with a suggested maintained alternative. It does not fill the repository template's What, Why, or Tickets sections. The Why context is covered by the advisory, but the What section is only implied by the update table, and no Jira ticket is linked.
Resolution
Add the repository template sections: a What section that states the change (bump golang.org/x/crypto v0.57.0 to v0.59.0 and the related indirect updates), a Why section that explains the security need (GO-2026-5932, openpgp package), and a Tickets section that links the related Jira issue, or states that none exists.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 6b7268e4-e291-40ee-81ae-5a4f8d1335e0
Commits
Reviewing files that changed from the base of the PR and between 3bc55d6 and b7ea577.
Files ignored due to path filters: 3
acceptance/go.sum is excluded by !**/*.sum
go.sum is excluded by !**/*.sum
tools/go.sum is excluded by !**/*.sum
Files selected for processing: 3
acceptance/go.mod
go.mod
tools/go.mod
Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 7 remain after this review.
Bot-authored security dependency update bumping golang.org/x/crypto across three Go modules; the change is purely go.mod/go.sum with no source code modifications, keeping implementation risk low, though the security label and 6 dependency files spanning multiple modules slightly elevate the score above minimal.
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
ready-for-merge
This PR contains the following updates:
v0.57.0→v0.59.0The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
GO-2026-5932
More information
Details
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.