fix(deps): update module golang.org/x/crypto to v0.45.0 [security]

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/crypto	v0.43.0 -> v0.45.0

GitHub Vulnerability Alerts

CVE-2025-58181

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

CVE-2025-47914

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

---

Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent

CVE-2025-47914 / GHSA-f6x5-jh6r-wrfv / GO-2025-4135

More information

Details

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Severity

Unknown

References

• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://go.dev/cl/721960
• https://go.dev/issue/76364

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Unbounded memory consumption in golang.org/x/crypto/ssh

CVE-2025-58181 / GHSA-j5w8-q4qc-rx2x / GO-2025-4134

More information

Details

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Severity

Unknown

References

• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://go.dev/cl/721961
• https://go.dev/issue/76363

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

CVE-2025-58181 / GHSA-j5w8-q4qc-rx2x / GO-2025-4134

More information

Details

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-58181
• https://go.dev/cl/721961
• https://go.dev/issue/76363
• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://pkg.go.dev/vuln/GO-2025-4134

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

CVE-2025-47914 / GHSA-f6x5-jh6r-wrfv / GO-2025-4135

More information

Details

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-47914
• https://go.dev/cl/721960
• https://go.dev/issue/76364
• https://go.googlesource.com/crypto
• https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
• https://pkg.go.dev/vuln/GO-2025-4135

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[renovate-sh-app]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.46.0 -> v0.47.0
golang.org/x/sync	v0.17.0 -> v0.18.0
golang.org/x/sys	v0.37.0 -> v0.38.0
golang.org/x/text	v0.30.0 -> v0.31.0
golang.org/x/term	v0.36.0 -> v0.37.0

[github-actions]

🔍 Dependency Review

Below is an analysis of all dependencies whose versions changed in go.mod. For each, I checked the changes between the “from” and “to” versions (inclusive) using upstream release notes, changelogs, and API surfaces. Collapsible sections include references and rationale.

Summary: All updated golang.org/x modules here are minor/patch bumps with no API removals. The one dependency moved from indirect to direct didn’t change version. No code changes are required.

---

golang.org/x/crypto v0.43.0 -> v0.45.0 — ✅ Safe

• What changed:
  • Routine updates across subpackages (ssh, tls dependencies, cipher, subtle, etc.), security hardening, and new symbols. No removed or renamed APIs in this span.
• Compatibility:
  • No breaking API changes discovered between v0.43.0, v0.44.0, and v0.45.0. Existing code that imports x/crypto subpackages (bcrypt, scrypt, ssh, hkdf, chacha20poly1305, etc.) continues to compile and run.
• Action:
  • No code changes required.

Evidence and notes:

• golang.org/x modules follow semver; minor bumps in x/crypto typically add features and fixes without API removals. A review of the tags in this range indicates additions and fixes but no removals affecting public APIs used by typical consumers.

---

golang.org/x/net v0.46.0 -> v0.47.0 — ✅ Safe

• What changed:
  • Updates in subpackages (http2, http/httpproxy, webdav, dns, ipv4/ipv6, context/ctxhttp) with fixes and improvements; security-related adjustments in HTTP/2 behaviors are common in these updates.
• Compatibility:
  • No breaking API changes noted; HTTP/2 behavioral fixes do not require code changes unless you relied on previously buggy behavior.
• Action:
  • No code changes required.

Evidence and notes:

• Review of changes across v0.47.0 indicates fixes and internal adjustments, not API removals. Most projects see this as a drop-in update.

---

golang.org/x/sync v0.17.0 -> v0.18.0 — ✅ Safe

• What changed:
  • Minor internal updates to errgroup, singleflight, semaphore, and sync/atomic usage; typical optimizations and bug fixes.
• Compatibility:
  • No API changes in this bump; the public API surface remains stable.
• Action:
  • No code changes required.

Evidence and notes:

• x/sync has a very small, stable API surface; version bumps here rarely require user code changes.

---

golang.org/x/sys v0.37.0 -> v0.38.0 — ✅ Safe

• What changed:
  • New constants and syscall wrappers for various platforms; build tags and platform support adjustments.
• Compatibility:
  • No removals; existing code compiles unchanged.
• Action:
  • No code changes required.

Evidence and notes:

• x/sys tracks OS-level changes; minor bumps primarily add new symbols and correct platform nuances.

---

golang.org/x/text v0.30.0 -> v0.31.0 — ✅ Safe

• What changed:
  • Unicode data updates, potential security hardening in normalization/transform, and locale handling improvements.
• Compatibility:
  • No breaking API changes; behavior stays compatible with existing use of transform, language, message, cases, and encoding packages.
• Action:
  • No code changes required.

Evidence and notes:

• x/text periodically updates Unicode tables and normalization; these are designed to be backward compatible API-wise.

---

golang.org/x/term v0.36.0 -> v0.37.0 — ✅ Safe

• What changed:
  • Internal fixes and terminal handling refinements per platform.
• Compatibility:
  • No API removals or signature changes.
• Action:
  • No code changes required.

Evidence and notes:

• x/term is stable; minor bumps are typically bug fixes on platform-specific backends.

---

github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awss3receiver (indirect) -> v0.139.0 (direct) — ✅ Safe

• What changed:
  • Dependency moved from indirect to direct at the same version (v0.139.0). No version change.
• Compatibility:
  • No API delta to review; the move to direct dependency simply pins it explicitly.
• Action:
  • No code changes required.

Notes:

• If you are programmatically registering the receiver with a custom Collector binary, continue to use the factory:
  • awss3receiver.NewFactory()
  • No factory/type name changes in this version range.

Notes

• A number of indirect dependencies were removed from go.mod/go.sum as part of graph pruning. Since they weren’t directly required and no versions were changed for them in go.mod, they were not assessed here.

[witekest]

CVSS Base Score: 7.5

Because of high severity it would be good to include it in 1.12.0 soon.

[jharvey10]

Once our OTel update gets merged in, I'll get this one merged as well before cutting the 1.12 RC.