fix: security dependency updates (golang.org/x/crypto, golang.org/x/net) - #113
fix: security dependency updates (golang.org/x/crypto, golang.org/x/net)#113sujit-jadhav wants to merge 1 commit into
Conversation
- Updated golang.org/x/crypto to v0.54.0 (CVE-2024-45337, CVE-2025-58181, CVE-2026-46595) - Updated golang.org/x/net to v0.56.0 Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> Signed-off-by: Sujit Jadhav <sujit.jadhav@dell.com>
b0000b1 to
2cb93ce
Compare
|
The CI build failure is not caused by this PR. The PRBuild.yml workflow uses goreleaser release --clean --skip=announce,validate,archive which attempts to push container images to ghcr.io/openchami/smd. Fork-based PRs don't have write access to the upstream org's container registry, resulting in: ERROR: failed to push ghcr.io/openchami/smd:0: denied: installation not allowed to Write organization package The code compiles and builds successfully — only the Docker push step fails due to permissions. This is a pre-existing issue in the CI workflow. For reference, the opaal repo avoids this by using --skip publish for PR builds. The dependency updates themselves are clean — verified locally with go build ./... and go mod tidy produces no changes |
| The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), | ||
| and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). | ||
|
|
||
| ## [v2.20.5] - 2026-08-05 |
There was a problem hiding this comment.
Can you change this to ## Unreleased? We'll worry about the version/date when a release is ready to be made.
2 participants
Summary
Bump security-sensitive Go dependencies to address known CVEs.
Changes
Testing
Signed-off-by: Sujit Jadhav sujit.jadhav@dell.com