Fix possible fix(deps): 6 vulnerable dependencies in go.mod - #12
begininvoke wants to merge 1 commit into
Conversation
![memcode-ai[bot]](https://avatars.githubusercontent.com/in/4775381?s=60&v=4){kind=small}
There was a problem hiding this comment.
Walkthrough
Updates four dependencies in go.mod (golang.org/x/image, golang.org/x/crypto, golang.org/x/text, and google.golang.org/grpc).
- The dependency version updates were manually edited directly in
go.modrather than generated viago getorgo mod tidy. go.sumwas left unchanged and is now out of sync with the upgraded module versions.- Leading tab indentation across all entries in both
requireblocks was stripped.
The dependency upgrades are desirable, but go.sum must be updated and formatting restored via go mod tidy before merging.
1 critical found.
| github.com/slack-go/slack v0.27.0 | ||
| github.com/spf13/cobra v1.10.2 | ||
| go.yaml.in/yaml/v4 v4.0.0-rc.2 | ||
| golang.org/x/image v0.45.0 |
There was a problem hiding this comment.
Missing go.sum checksums for updated dependencies
Upgraded module versions were committed to go.mod without updating go.sum. CI and Go builds will fail checksum verification or require network access to download and update checksums.
go.mod requires golang.org/x/image v0.45.0, but go.sum only contains v0.43.0.
Fix: Run go mod tidy to regenerate valid checksums in go.sum.
|
Thanks for the report, and for saying up front that closing it was fine. Closing this one, but the scan was useful. Details on why, in case it helps tune the tool: The CVE does not reach us. CVE-2026-56854 is in The diff reformats go.mod. It is +92/-92 for what is a single version bump, because every line in the require blocks lost its leading tab. The title reads Running |
2 participants
Proposing a fix for something flagged in
go.mod. It is around line 1.CRITICAL vulnerability in golang.org/x/crypto/ssh (installed v0.53.0, file: go.mod). CVE-2026-56854 extends the incomplete fix for CVE-2026-46595: the source-address critical option in Permissions returned by authentication callbacks was only enforced on the PublicKeyCallback and VerifiedPublicKeyCallback code paths. As a result, source-address restrictions set via Permissions.CriticalOptions by PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, or GSSAPIWithMICConfig.AllowLogin are silently ignored and never validated against the client's remote address. Impact: an SSH server that relies on source-address IP allowlisting with password/keyboard-interactive/none/GSSAPI authentication can be accessed by an attacker with valid credentials (or any client, in the NoClientAuth case) from any network location, defeating intended network-level access restrictions and enabling unauthorized remote access. Risk level: CRITICAL — this is an access-control bypass affecting authentication logic in a widely used SSH server library; exposure is highest for internet-facing or multi-tenant SSH servers using non-public-key auth with source-address restrictions. Remediation: upgrade to golang.org/x/crypto v0.55.0, where the source-address check is applied uniformly to Permissions returned by any authentication callback.
Updates vulnerable dependencies to versions that fix reported CVEs.
For reference: rule
CVE-2026-56854. Rated critical.I may well be missing context here — if the current code is deliberate, feel free to close this.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.