tools: bump x/net and x/crypto to clear high-severity CVE alerts - #48822
Conversation
…alerts Bump indirect deps in the dibble, hangar, terraform, and github-manage tool modules to align with the root fleet module: - golang.org/x/net -> v0.55.0 (CVE-2026-25681, -27136, -33814, -39821, -42502) - golang.org/x/crypto -> v0.52.0 (CVE-2026-39827..-39835, -42508, -46595, -46597) Resolves the 39 high-severity code-scanning alerts in tools/ that stem from outdated x/net and x/crypto versions.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (4)
WalkthroughThis PR updates Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Tools execution failed with the following error: Failed to run tools: Stream initialization permanently failed: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Updates indirect golang.org/x/net and golang.org/x/crypto dependencies across the Go modules under tools/ to match the root Fleet module and clear high-severity code-scanning alerts for internal tooling.
Changes:
- Bump
golang.org/x/nettov0.55.0intools/dibble,tools/hangar,tools/terraform, andtools/github-manage. - Bump
golang.org/x/cryptotov0.52.0intools/dibble,tools/hangar, andtools/terraform. - Refresh corresponding
go.sumentries (and related transitivex/*modules) as a result of the dependency updates.
Reviewed changes
Copilot reviewed 4 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| tools/terraform/go.mod | Updates indirect x/* versions including x/net and x/crypto for the terraform tooling module. |
| tools/terraform/go.sum | Updates checksums to match the new go.mod dependency graph. |
| tools/hangar/go.mod | Bumps indirect x/net/x/crypto (and x/sys) for the hangar tooling module. |
| tools/hangar/go.sum | Updates checksums to match the bumped x/* dependencies. |
| tools/github-manage/go.mod | Bumps indirect x/net (plus related x/*) for the GitHub management tooling module. |
| tools/github-manage/go.sum | Updates checksums to match the updated indirect x/* dependencies. |
| tools/dibble/go.mod | Bumps indirect x/net/x/crypto (plus related x/*) for the dibble tooling module. |
| tools/dibble/go.sum | Updates checksums to match the updated dependency graph. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Related issue: NA — resolves high-severity code-scanning alerts in
tools/Bumps the outdated
golang.org/x/netandgolang.org/x/cryptoindirectdependencies in the four
tools/Go modules to clear 39 high-severitycode-scanning (SCA) alerts on
main. Target versions match the root Fleetmodule.
tools/dibbletools/hangartools/terraformtools/github-manageCVEs cleared:
All four modules
go mod verifyclean and build. Dependency-only change tointernal dev tooling — no product code, no user-visible behavior.
Checklist for submitter
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Summary by CodeRabbit