fix(deps): vuln minor upgrades — 7 packages (minor: 6 · patch: 1)

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 7 packages upgraded (MINOR changes included)

Manifests changed:

• . (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
golang.org/x/crypto	v0.37.0	v0.54.0	minor	Transitive	21 CRITICAL, 8 HIGH, 18 MEDIUM, 1 UNKNOWN
golang.org/x/net	v0.39.0	v0.57.0	minor	Transitive	2 CRITICAL, 2 HIGH, 13 MEDIUM, 2 UNKNOWN
github.com/go-git/go-git/v5	v5.14.0	v5.19.2	minor	Direct	3 HIGH, 14 MEDIUM, 6 LOW
github.com/go-git/go-billy/v5	v5.6.2	v5.9.1	minor	Direct	3 HIGH, 3 MEDIUM
golang.org/x/sys	v0.32.0	v0.47.0	minor	Transitive	1 UNKNOWN
golang.org/x/text	v0.24.0	v0.40.0	minor	Direct	1 UNKNOWN
github.com/cloudflare/circl	v1.6.1	v1.6.4	patch	Transitive	3 LOW

---

Security Details

🚨 Critical & High Severity (39 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
golang.org/x/crypto	GHSA-f5wc-c3c7-36mc	CRITICAL	golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys	v0.37.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39832	critical	Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent	v0.37.0	-	-
golang.org/x/crypto	CVE-2026-39833	CRITICAL	Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent	v0.37.0	-	-
golang.org/x/crypto	GO-2026-5005	CRITICAL	Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent	v0.37.0	0.52.0	-
golang.org/x/crypto	GHSA-5cgq-3rg8-m6cv	CRITICAL	golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status	v0.37.0	0.52.0	-
golang.org/x/crypto	CVE-2026-42508	CRITICAL	Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts	v0.37.0	-	-
golang.org/x/crypto	GO-2026-5017	CRITICAL	Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh	v0.37.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39830	CRITICAL	Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh	v0.37.0	-	-
golang.org/x/crypto	GHSA-vgwf-h737-ff37	CRITICAL	golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses	v0.37.0	0.52.0	-
golang.org/x/crypto	GO-2026-5021	CRITICAL	Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts	v0.37.0	0.52.0	-
golang.org/x/crypto	GO-2026-5023	critical	Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh	v0.37.0	0.52.0	-
golang.org/x/crypto	GO-2026-5020	CRITICAL	Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh	v0.37.0	0.52.0	-
golang.org/x/crypto	GHSA-x527-x647-q7gg	CRITICAL	golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement	v0.37.0	0.52.0	-
golang.org/x/crypto	CVE-2026-46595	critical	Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh	v0.37.0	-	-
golang.org/x/crypto	CVE-2026-39834	CRITICAL	Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh	v0.37.0	-	-
golang.org/x/crypto	GHSA-jppx-rxg9-jmrx	CRITICAL	golang.org/x/crypto doesn't enforce invoking key constraints	v0.37.0	0.52.0	-
golang.org/x/crypto	GO-2026-5006	critical	Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent	v0.37.0	0.52.0	-
golang.org/x/crypto	GHSA-rm3j-f69w-wqmq	CRITICAL	golang.org/x/crypto vulnerable to infinite loop on large channel writes	v0.37.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39831	CRITICAL	Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh	v0.37.0	-	-
golang.org/x/crypto	GO-2026-5019	CRITICAL	Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh	v0.37.0	0.52.0	-
golang.org/x/crypto	GHSA-89gr-r52h-f8rx	CRITICAL	golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed	v0.37.0	0.52.0	-
golang.org/x/net	GO-2026-5026	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.39.0	0.55.0	-
golang.org/x/net	CVE-2026-39821	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.39.0	-	-
github.com/go-git/go-billy/v5	GO-2026-5597	high	Go-billy has path traversal vulnerabilities in github.com/go-git/go-billy	v5.6.2	5.9.0	-
github.com/go-git/go-billy/v5	CVE-2026-44973	high	Billy: Path traversal vulnerabilities	v5.6.2	-	-
github.com/go-git/go-billy/v5	GHSA-qw64-3x98-g7q2	HIGH	go-billy has path traversal vulnerabilities	v5.6.2	5.9.0	-
github.com/go-git/go-git/v5	GHSA-389r-gv7p-r3rp	HIGH	go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git	v5.14.0	5.19.0	-
github.com/go-git/go-git/v5	GO-2026-5074	HIGH	Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git	v5.14.0	5.19.0	-
github.com/go-git/go-git/v5	CVE-2026-45022	HIGH	go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git	v5.14.0	-	-
golang.org/x/crypto	GHSA-56w8-48fp-6mgv	HIGH	golang.org/x/crypto/ssh/agent has a potential denial of service	v0.37.0	-	-
golang.org/x/crypto	GO-2025-4116	HIGH	Potential denial of service in golang.org/x/crypto/ssh/agent	v0.37.0	0.43.0	-
golang.org/x/crypto	GO-2026-5013	HIGH	Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh	v0.37.0	0.52.0	-
golang.org/x/crypto	CVE-2026-46597	HIGH	Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh	v0.37.0	-	-
golang.org/x/crypto	GHSA-q4h4-gmj2-qvw2	HIGH	golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic	v0.37.0	0.52.0	-
golang.org/x/crypto	GHSA-w879-237q-wc7r	HIGH	golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS	v0.37.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39829	high	Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh	v0.37.0	-	-
golang.org/x/crypto	GO-2026-5018	high	Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh	v0.37.0	0.52.0	-
golang.org/x/net	CVE-2026-33814	high	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.39.0	-	-
golang.org/x/net	GO-2026-4918	high	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.39.0	0.53.0	-

ℹ️ Other Vulnerabilities (62)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/go-git/go-git/v5	GO-2026-4473	medium	Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git	v5.14.0	5.16.5	-
github.com/go-git/go-git/v5	CVE-2026-45571	medium	go-git: Crafted repositories may modify main and submodule .git directories	v5.14.0	-	-
github.com/go-git/go-git/v5	GO-2026-5336	medium	Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git	v5.14.0	5.19.1	-
github.com/go-git/go-git/v5	CVE-2026-41506	medium	go-git Credential leak via cross-host redirect in smart HTTP transport	v5.14.0	-	-
github.com/go-git/go-git/v5	GO-2026-5105	medium	Go-git: Credential leak via cross-host redirect in smart HTTP transport in github.com/go-git/go-git	v5.14.0	5.18.0	-
github.com/go-git/go-git/v5	CVE-2026-25934	medium	go-git improperly verifies data integrity values for .idx and .pack files	v5.14.0	-	-
golang.org/x/crypto	GO-2026-5033	medium	Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent	v0.37.0	0.52.0	-
golang.org/x/crypto	CVE-2026-46598	medium	Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent	v0.37.0	-	-
golang.org/x/net	GO-2026-5027	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.39.0	0.55.0	-
golang.org/x/net	GO-2026-5025	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.39.0	0.55.0	-
golang.org/x/net	GO-2026-5029	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.39.0	0.55.0	-
golang.org/x/net	CVE-2026-25681	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.39.0	-	-
golang.org/x/net	CVE-2026-42506	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.39.0	-	-
golang.org/x/net	CVE-2026-42502	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.39.0	-	-
golang.org/x/net	GO-2026-5030	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.39.0	0.55.0	-
golang.org/x/net	CVE-2026-27136	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.39.0	-	-
github.com/go-git/go-billy/v5	GHSA-m3xc-h892-ggx6	MODERATE	go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion	v5.6.2	5.9.0	-
github.com/go-git/go-billy/v5	GO-2026-5490	MODERATE	Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy	v5.6.2	5.9.0	-
github.com/go-git/go-billy/v5	CVE-2026-44740	MODERATE	go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion	v5.6.2	-	-
github.com/go-git/go-git/v5	GHSA-3xc5-wrhm-f963	MODERATE	go-git: Credential leak via cross-host redirect in smart HTTP transport	v5.14.0	5.18.0	-
github.com/go-git/go-git/v5	GHSA-w5pp-99ch-qj29	MODERATE	go-git: Malformed Git object data may cause panics or resource exhaustion	v5.14.0	5.19.1	-
github.com/go-git/go-git/v5	GO-2026-5693	MODERATE	Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git	v5.14.0	5.19.1	-
github.com/go-git/go-git/v5	CVE-2026-34165	MODERATE	go-git: Maliciously crafted idx file can cause asymmetric memory consumption	v5.14.0	-	-
github.com/go-git/go-git/v5	GHSA-jhf3-xxhw-2wpp	MODERATE	go-git: Maliciously crafted idx file can cause asymmetric memory consumption	v5.14.0	5.17.1	-
github.com/go-git/go-git/v5	GO-2026-4910	MODERATE	Maliciously crafted idx file can cause asymmetric memory consumption in github.com/go-git/go-git	v5.14.0	5.17.1	-
github.com/go-git/go-git/v5	GHSA-37cx-329c-33x3	MODERATE	go-git improperly verifies data integrity values for .idx and .pack files	v5.14.0	5.16.5	-
github.com/go-git/go-git/v5	GHSA-crhj-59gh-8x96	MODERATE	go-git: Crafted repositories may modify main and submodule .git directories	v5.14.0	5.19.1	-
golang.org/x/crypto	CVE-2026-39835	MODERATE	Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh	v0.37.0	-	-
golang.org/x/crypto	GO-2026-5016	MODERATE	Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh	v0.37.0	0.52.0	-
golang.org/x/crypto	GHSA-f6x5-jh6r-wrfv	MODERATE	golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read	v0.37.0	0.45.0	-
golang.org/x/crypto	GO-2025-4135	MODERATE	Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent	v0.37.0	0.45.0	-
golang.org/x/crypto	CVE-2025-47914	MODERATE	Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent	v0.37.0	-	-
golang.org/x/crypto	GHSA-78mq-xcr3-xm33	MODERATE	golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow	v0.37.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39828	MODERATE	Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh	v0.37.0	-	-
golang.org/x/crypto	GO-2026-5015	MODERATE	Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh	v0.37.0	0.52.0	-
golang.org/x/crypto	GHSA-j5w8-q4qc-rx2x	MODERATE	golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption	v0.37.0	0.45.0	-
golang.org/x/crypto	CVE-2025-58181	MODERATE	Unbounded memory consumption in golang.org/x/crypto/ssh	v0.37.0	-	-
golang.org/x/crypto	GHSA-45gg-vh54-h5m9	MODERATE	golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions	v0.37.0	0.52.0	-
golang.org/x/crypto	GO-2026-5014	MODERATE	Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh	v0.37.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39827	MODERATE	Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh	v0.37.0	-	-
golang.org/x/crypto	GO-2025-4134	MODERATE	Unbounded memory consumption in golang.org/x/crypto/ssh	v0.37.0	0.45.0	-
golang.org/x/crypto	GHSA-9m57-25v3-79x9	MODERATE	golang.org/x/crypto: Invoking pathological inputs can lead to client panic	v0.37.0	0.52.0	-
golang.org/x/crypto	GHSA-qpw4-5x99-6vjp	MODERATE	golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS	v0.37.0	0.52.0	-
golang.org/x/net	GO-2026-5028	MODERATE	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.39.0	0.55.0	-
golang.org/x/net	GO-2026-4440	MODERATE	Quadratic parsing complexity in golang.org/x/net/html	v0.39.0	0.45.0	-
golang.org/x/net	GHSA-w4gw-w5jq-g9jh	MODERATE	golang.org/x/net/html has a Quadratic Parsing Complexity issue	v0.39.0	-	-
golang.org/x/net	CVE-2026-25680	MODERATE	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.39.0	-	-
golang.org/x/net	GHSA-5cv4-jp36-h3mw	MODERATE	Go Net HTML parser is vulnerable to denial of service	v0.39.0	0.55.0	-
github.com/cloudflare/circl	GO-2026-4550	low	CIRCL has an incorrect calculation in secp384r1 CombinedMult in github.com/cloudflare/circl	v1.6.1	1.6.3	-
github.com/cloudflare/circl	CVE-2026-1229	low	Incorrect calculation in CIRCL secp384r1 CombinedMult	v1.6.1	-	-
github.com/cloudflare/circl	GHSA-q9hv-hpm4-hj6x	LOW	CIRCL has an incorrect calculation in secp384r1 CombinedMult	v1.6.1	1.6.3	-
github.com/go-git/go-git/v5	GHSA-gm2x-2g9h-ccm8	LOW	go-git missing validation decoding Index v4 files leads to panic	v5.14.0	5.17.1	-
github.com/go-git/go-git/v5	CVE-2026-33762	LOW	go-git: Missing validation decoding Index v4 files leads to panic	v5.14.0	-	-
github.com/go-git/go-git/v5	GO-2026-4909	LOW	Missing validation decoding Index v4 files leads to panic in github.com/go-git/go-git	v5.14.0	5.17.1	-
github.com/go-git/go-git/v5	GO-2026-5496	low	Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git	v5.14.0	5.19.1	-
github.com/go-git/go-git/v5	CVE-2026-45570	low	go-git: Improper single-quote escaping in go-git SSH transport	v5.14.0	-	-
github.com/go-git/go-git/v5	GHSA-m7cr-m3pv-hgrp	LOW	go-git: Improper single-quote escaping in go-git SSH transport	v5.14.0	5.19.1	-
golang.org/x/crypto	GO-2026-5932	unknown	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	v0.37.0	-	-
golang.org/x/net	GO-2026-4441	unknown	Infinite parsing loop in golang.org/x/net	v0.39.0	0.45.0	-
golang.org/x/net	GO-2026-5942	unknown	Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage	v0.39.0	0.56.0	-
golang.org/x/sys	GO-2026-5024	unknown	Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows	v0.32.0	0.44.0	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.24.0	0.39.0	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System