build: bump golang.org/x/crypto to v0.36.0 to solve CVE-2025-22869 #23966
Conversation
📝 WalkthroughWalkthroughThe changes update several dependency versions in the project's Changes
Possibly related PRs
Suggested labels
Suggested reviewers
Warning There were issues while running some tools. Please review the errors and either fix the tool’s configuration or disable the tool if it’s a critical failure. 🔧 golangci-lint (1.62.2)level=warning msg="[runner] Can't run linter goanalysis_metalinter: buildir: failed to load package sqlite3: could not load export data: no export data for "github.com/bvinc/go-sqlite-lite/sqlite3"" 📜 Recent review detailsConfiguration used: .coderabbit.yml ⛔ Files ignored due to path filters (26)
📒 Files selected for processing (26)
🚧 Files skipped from review as they are similar to previous changes (1)
🧰 Additional context used📓 Path-based instructions (1)`tests/**/*`: "Assess the integration and e2e test code asse...
⏰ Context from checks skipped due to timeout of 90000ms (3)
🔇 Additional comments (29)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
go.mod (1)
158-161: Verify consistency of indirect dependency updates.The updates for
golang.org/x/sync(v0.12.0),golang.org/x/sys(v0.31.0),golang.org/x/term(v0.30.0), andgolang.org/x/text(v0.23.0) appear consistent with the overall bump in dependency versions. Confirm that these new versions do not introduce any unintended side effects in the modules that depend on them.
📜 Review details
Configuration used: .coderabbit.yml
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod(2 hunks)
🧰 Additional context used
🪛 GitHub Actions: v2 core Tests
go.mod
[warning] 1-1: updates to go.mod needed, disabled by -mod=readonly; to update it: go mod tidy
⏰ Context from checks skipped due to timeout of 90000ms (5)
- GitHub Check: tests (03)
- GitHub Check: tests (02)
- GitHub Check: tests (01)
- GitHub Check: tests (00)
- GitHub Check: Summary
🔇 Additional comments (2)
go.mod (2)
53-53: Update togolang.org/x/cryptofor CVE mitigation.The version bump from
v0.32.0tov0.36.0directly addresses CVE-2025-22869. Ensure that this update has been tested against your codebase to verify there are no compatibility issues.
1-206:Details
✅ Verification successful
Run
go mod tidyto update module metadata.The pipeline failure indicates that updates to
go.modare being blocked by the-mod=readonlyflag. After updating dependency versions, please rungo mod tidyto refresh both thego.modandgo.sumfiles.To verify, run the following command:
🏁 Script executed:
go mod tidyLength of output: 10512
Update Verified – Module Metadata Refreshed
The output from running
go mod tidyshows that dependency downloads were triggered without any errors, indicating that the module metadata (bothgo.modandgo.sum) has been refreshed. Please ensure that the updated files are committed to the repository so that the pipeline no longer encounters issues with the-mod=readonlyflag.
- Confirm that the updated
go.modandgo.sumfiles reflect the necessary dependency changes.- Commit these changes, if not already done, to unblock the pipeline.
🧰 Tools
🪛 GitHub Actions: v2 core Tests
[warning] 1-1: updates to go.mod needed, disabled by -mod=readonly; to update it: go mod tidy
tinyfoxy
force-pushed
the
build/upgrade-crypto
branch
from
b0597cf to
5fe51e9
Compare
github-actions
bot
added
C:x/staking
C:CLI
C:x/gov
C:x/slashing
C:x/distribution
2 participants
Description
there is a issue about [email protected]
https://ossindex.sonatype.org/vulnerability/CVE-2025-22869?component-type=golang&component-name=golang.org%2Fx%2Fcrypto&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.46
Summary by CodeRabbit