Bump grpc, x/crypto and the pending patch updates with a fresh Nix vendorHash - #422
Bump grpc, x/crypto and the pending patch updates with a fresh Nix vendorHash#422jeremy wants to merge 2 commits into
Conversation
…ates grpc 1.83.1 closes CVE-2026-84304 (HTTP/2 DATA frame fragmentation OOM) and x/crypto 0.56.0 closes GO-2026-6354/6355 (ssh channel deadlock DoS); neither package is called from hey-cli, so this clears the scanners rather than a live path. bubbles 2.2.1, flock 0.13.1, go-runewidth 0.0.29 and goldmark 1.8.6 are the patch bumps dependabot has open, and the smoke test module's x/sys moves to 0.44.0 for GO-2026-5024.
There was a problem hiding this comment.
🔵 Needs a closer look
Critical Nix, test, lint, race, and platform checks were still running at review time.
Pull request overview
Updates security-sensitive and pending Go dependencies while refreshing Nix vendoring metadata.
Changes:
- Bumps gRPC, x/crypto, and four direct dependencies.
- Updates smoke-test x/sys.
- Regenerates the Nix
vendorHash.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
go.mod |
Updates root dependency versions. |
go.sum |
Refreshes root module checksums. |
tests/smoke/go.mod |
Bumps smoke-test x/sys. |
tests/smoke/go.sum |
Refreshes smoke module checksums. |
nix/package.nix |
Updates the vendored dependency hash. |
Review details
- Files reviewed: 3/5 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
One pass over the open Go dependency bumps, with the Nix
vendorHashregenerated (make update-nix-hash, Docker-verified build), which is the step dependabot cannot take and the reason each of its PRs sits red on "Nix flake builds".Bumps:
Alerts this closes, and the verdict on each:
govulncheckshows no call path. Bumped to clear it.govulncheckreports both as imported-but-uncalled. Bumped to clear them.govulncheck ./...before: 0 reachable, 2 imported-uncalled (x/crypto), 1 required-uncalled (grpc). After: 0 reachable, 0 imported, 1 required-uncalled (GO-2026-5932, no fix exists).Local gate:
make check,make vuln,make gosec,make race-testpass;make test-e2epasses every nix and lockstep test, with the only failures being the fiveinstall_ssh_key.batscases that use GNUstat -cin their assert helper and fail on macOS regardless of branch.Supersedes #414, #413, #386, #376 and #375.
Summary by cubic
Bumps pending Go dependency updates and regenerates the Nix
vendorHashso the dependabot PRs no longer fail on Nix flake builds.google.golang.org/grpcto 1.83.1,golang.org/x/cryptoto 0.56.0, plus patch bumps forcharm.land/bubbles/v2,github.com/gofrs/flock,github.com/mattn/go-runewidth, andgithub.com/yuin/goldmark.golang.org/x/sysin the smoke test module to clear GO-2026-5024.govulncheckshows no reachable call path for either.x/crypto/openpgpunmaintained) has no fixed version and will keep reporting one entry after merge.Written for commit 385b740. Summary will update on new commits.