Bump golang.org/x/crypto and golang.org/x/sys - #3269
Closed
acts-1631 wants to merge 1 commit into
Closed
Conversation
Updates x/crypto 0.53.0 -> 0.54.0 and x/sys 0.46.0 -> 0.47.0, the two golang.org/x modules that dependabot did not pick up (PRs DNSCrypt#3257, DNSCrypt#3261, DNSCrypt#3265, DNSCrypt#3266 cover circl, miekg/dns, kardianos/service and powerman/check but not these). go mod tidy also drops the unused github.com/miekg/dns module and a few stale indirect deps; the same cleanup shows up in DNSCrypt#3257, so whichever merges first the other rebases cleanly. The vendor tree was regenerated to match.
Member
|
None of the security issues affecting the current dependencies are relevant to DNSCrypt-proxy. With supply chain attacks being all the rage, I can't merge such pull requests. Hope you understand. |
Author
|
Okay, no problem. I'll still ask that you please consider keeping the deps up to date yourself then as we follow new Go releases with regular security updates. Cutting a dnscrypt-proxy release when affected dependencies are vulnerable would be much appreciated for distros. Thanks for the quick reply. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps golang.org/x/crypto 0.53.0 -> 0.54.0 and golang.org/x/sys
0.46.0 -> 0.47.0. These are the two golang.org/x modules dependabot
didn't open PRs for (circl #3257, miekg/dns #3261, kardianos/service
#3265 and powerman/check #3266 cover the rest).
Running go mod tidy also drops the unused github.com/miekg/dns module
and a few stale indirect deps. That same cleanup is in #3257, so
whichever merges first the other should rebase cleanly.
Vendor tree regenerated. Build, go vet and the test suite pass locally.
It would also be appreciated if a new release could be cut whenever
Go security fixes need to land, so downstream users can pick them up
without having to build from source.