chore(deps): bump golang.org/x/crypto to 0.53.0 across all affected extension modules - #9027
Conversation
…modules
Bumps golang.org/x/crypto (and required transitive golang.org/x/{net,sys,term,text})
to v0.53.0 in every extension module still on a vulnerable version (< 0.52.0),
resolving the batch of Dependabot SSH/crypto security advisories in a single PR
instead of one PR per module.
Modules updated:
- microsoft.azd.concurx (0.48.0)
- azure.appservice (0.48.0)
- azure.coding-agent (0.48.0)
- azure.ai.finetune (0.48.0)
- azure.ai.models (0.48.0)
- azure.ai.projects (0.49.0)
- azure.ai.inspector (0.49.0)
- azure.ai.training (0.49.0)
- azure.ai.skills (0.49.0)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
🔗 Linked Issue RequiredThanks for the contribution! Please link a GitHub issue to this PR by adding |
github-actions
Bot
added
ext-appservice
github-actions
Bot
added
ext-models
There was a problem hiding this comment.
Pull request overview
This PR bumps golang.org/x/crypto to v0.53.0 (and its required transitive golang.org/x/{net,sys,term,text}, plus mod/sync/tools where present) across the 9 extension modules that were still on a vulnerable pre-0.52.0 version. It consolidates a batch of Dependabot SSH/crypto security advisories (e.g. #9026) into a single PR instead of ~10 near-identical per-module PRs. It fits into the repo's multi-module layout where each first-party extension under cli/azd/extensions/ maintains its own go.mod/go.sum.
Changes:
- Bumps
golang.org/x/cryptofrom0.48.0/0.49.0→0.53.0and aligns transitivex/net,x/sys,x/term,x/text(andx/mod/x/sync/x/toolsforazure.coding-agent). - Only
go.mod/go.sumfiles change; two incidentalgo mod tidycorrections movegoogle.golang.org/protobuf(skills) andgithub.com/spf13/pflag(inspector) fromindirectto direct requires. - After this change every module in the repo is at crypto
v0.53.0, above the0.52.0advisory fix line.
Verification performed: no other Go module in the repo remains on a vulnerable crypto version; the crypto v0.53.0, sys v0.46.0, term v0.44.0, and text v0.38.0 checksums exactly match those already committed and building in CI in the core cli/azd/go.sum; and the net v0.55.0 hashes are consistent across all 9 extension go.sum files. No issues were found.
Reviewed changes
Copilot reviewed 9 out of 18 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
cli/azd/extensions/microsoft.azd.concurx/go.mod / go.sum |
crypto 0.48.0→0.53.0 + transitive net/sys/term/text bumps |
cli/azd/extensions/azure.appservice/go.mod / go.sum |
crypto 0.48.0→0.53.0 + transitive bumps |
cli/azd/extensions/azure.coding-agent/go.mod / go.sum |
crypto 0.48.0→0.53.0 + net/sys/term/text/mod/sync/tools bumps |
cli/azd/extensions/azure.ai.finetune/go.mod / go.sum |
crypto 0.48.0→0.53.0 + transitive bumps |
cli/azd/extensions/azure.ai.models/go.mod / go.sum |
crypto 0.48.0→0.53.0 + transitive bumps |
cli/azd/extensions/azure.ai.projects/go.mod / go.sum |
crypto 0.49.0→0.53.0 + transitive bumps |
cli/azd/extensions/azure.ai.inspector/go.mod / go.sum |
crypto 0.49.0→0.53.0 + transitive bumps; pflag moved to direct require |
cli/azd/extensions/azure.ai.training/go.mod / go.sum |
crypto 0.49.0→0.53.0 + transitive bumps |
cli/azd/extensions/azure.ai.skills/go.mod / go.sum |
crypto 0.49.0→0.53.0 + transitive bumps; protobuf moved to direct require |
richardpark-msft
left a comment
richardpark-msft
left a comment
There was a problem hiding this comment.
It looks fine, curious about why some of the go.mod's now have new deps in them, but none of them are objectionable and (I'm guessing) it was just them adding a dep and never tidy'ing? (probably something we should add into the build pipelines to check)
|
/check-enforcer override |
Summary
Bumps
golang.org/x/cryptoto v0.53.0 in every extension module that was still on a vulnerable version (< 0.52.0). Becausecrypto@v0.53.0requiresgolang.org/x/net@v0.55.0, this also transitively bumpsgolang.org/x/net(andgolang.org/x/{sys,term,text}) to their fixed versions.This addresses the batch of open Dependabot SSH/crypto and
x/netsecurity advisories in a single PR rather than one PR per module.Why one PR instead of many
Dependabot is auto-generating a separate PR per affected
go.mod:x/cryptobump formicrosoft.azd.concurxonlyx/netbump formicrosoft.azd.concurxonlyRather than merge ~20 near-identical PRs (two deps × ~10 modules), this PR updates all of them at once. The individual Dependabot PRs can be closed once this merges.
Modules updated
microsoft.azd.concurxazure.appserviceazure.coding-agentazure.ai.finetuneazure.ai.modelsazure.ai.projectsazure.ai.inspectorazure.ai.trainingazure.ai.skillsModules already on
crypto v0.53.0(cli/azd,azure.ai.agents,azure.ai.connections,azure.ai.routines,azure.ai.toolboxes) are unchanged and already carrynet v0.56.0. After this change, every module in the repo is atcrypto v0.53.0andnet >= v0.55.0, above both advisory fix lines (crypto 0.52.0, net 0.55.0).Related Dependabot PRs (superseded)
x/cryptoformicrosoft.azd.concurx)x/netformicrosoft.azd.concurx)Validation
go get golang.org/x/crypto@v0.53.0+go mod tidyin each modulego build ./...passes for every updated modulego.mod/go.sumfiles are modifiedCo-authored-by: Copilot 223556219+Copilot@users.noreply.github.com