🌱 Bump golang.org/x/crypto from 0.48.0 to 0.52.0

[dependabot]

Bumps golang.org/x/crypto from 0.48.0 to 0.52.0.

Commits

• a1c0d99 go.mod: update golang.org/x dependencies
• 3c7c869 ssh: fix deadlock on unexpected channel responses
• 533fb3f ssh: fix source-address critical option bypass
• abbc44d ssh: fix incorrect operator order
• e052873 ssh: fix infinite loop on large channel writes due to integer overflow
• b61cf85 ssh: enforce user presence verification for security keys
• 9c2cd33 ssh: enforce strict limits on DSA key parameters
• 8907318 ssh: reject RSA keys with excessively large moduli
• ffd87b4 ssh: fix panic when authority callbacks are nil
• 4e7a738 ssh: fix deadlock on unexpected global responses
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[netlify]

✅ Deploy Preview for ossf-scorecard canceled.

Name	Link
🔨 Latest commit	4aebfc4
🔍 Latest deploy log	https://app.netlify.com/projects/ossf-scorecard/deploys/6a513569e9bbd6000855adcc

[kusari-inspector]

Kusari Analysis Results:

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

The code analysis is clean with zero issues across all categories (no code issues, no exposed secrets, no workflow issues). However, the dependency analysis identifies an active, unmitigated high-severity vulnerability that warrants strong caution before merging. While this PR is a net security improvement — resolving 13+ vulnerabilities in older golang.org/x/crypto and several in golang.org/x/net — the newly introduced golang.org/x/net v0.54.0 carries CVE-2026-39821 (CVSS: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H), an IDNA privilege escalation flaw where ToASCII/ToUnicode incorrectly accepts Punycode-encoded labels that resolve to ASCII-only hostnames (e.g., 'xn--example-.com' resolving to 'example.com'). This can be exploited by low-privileged network attackers to bypass hostname-based access controls, with high confidentiality and integrity impact and a Changed scope. The vulnerability is not cleared by govulncheck and a direct fix is available. We strongly recommend updating golang.org/x/net to v0.57.0 before merging. Action item: run 'go get golang.org/x/net@v0.57.0', verify go.mod and go.sum are consistent, and confirm no new vulnerabilities or build incompatibilities are introduced by the transitive upgrade.

Note

View full detailed analysis result for more information on the output and the checks that were run.

Required Dependency Mitigations

• CRITICAL: golang.org/x/net v0.54.0 - Active Privilege Escalation Vulnerability (CVE-2026-39821)

Summary: The golang.org/x/net/idna package (ToASCII/ToUnicode) incorrectly accepts Punycode-encoded labels that decode to ASCII-only labels (e.g., 'xn--example-.com' resolves to 'example.com'). This can enable privilege escalation in applications performing hostname-based access control.

CVSS: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Status: NOT marked as not-affected. Govulncheck did not clear this finding.

Dependency path: golang.org/x/net@v0.54.0 is pulled in via multiple roots:

• gocloud.dev@v0.45.0 → golang.org/x/net@v0.54.0
• github.com/go-openapi/runtime@v0.29.3 → golang.org/x/net@v0.54.0

Fix: Update golang.org/x/net to v0.57.0 which resolves this vulnerability.
Command: go get golang.org/x/net@v0.57.0

Note: Upgrading to v0.57.0 may transitively bump other golang.org/x/* packages. Verify the resulting go.mod does not introduce build incompatibilities or new vulnerabilities.

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 4aebfc4, performed at: 2026-07-10T18:10:52Z

Found this helpful? Give it a 👍 or 👎 reaction!