Repository navigation
Update module golang.org/x/crypto to v0.59.0 [SECURITY] (release-v0.9) - #3710
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
ℹ️ Artifact update noticeFile name: acceptance/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: tools/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
|
🤖 Finished Review · ✅ Success · Started 5:47 AM UTC · Completed 5:56 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.17 |
|
Risk Assessment: moderate (2/5) DetailsBot-authored security patch updating golang.org/x/crypto across three Go modules; dependency signal is elevated (6 dep files = 5) but all other Tier 1 dimensions are low (no protected paths, no CI changes, bot author), yielding a Tier 1 score of 1.75, while Tier 2 reflects moderate but unremarkable churn and contention on dependency files; composite 0.62×1.75 + 0.38×2.42 ≈ 2. |
|
Looks good to me Labels: Dependency file update across Go modules — adding standard dependency and language labels. |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
ready-for-merge
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
This PR contains the following updates:
v0.57.0→v0.59.0The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
GO-2026-5932
More information
Details
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.