Skip to content

[Cycode] Fix for vulnerable manifest file dependency - golang.org/x/crypto updated to version 0.52.0 - #99

Open
cycode-security[bot] wants to merge 1 commit into
mainfrom
cycode-fix-suggestion-manifest-dependency-update-ca00a59b-9433-433e-8a8e-b8391bcbba21
Open

[Cycode] Fix for vulnerable manifest file dependency - golang.org/x/crypto updated to version 0.52.0#99
cycode-security[bot] wants to merge 1 commit into
mainfrom
cycode-fix-suggestion-manifest-dependency-update-ca00a59b-9433-433e-8a8e-b8391bcbba21

Conversation

@cycode-security

@cycode-security cycode-security Bot commented Jul 7, 2026

Copy link
Copy Markdown

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path Number of packages to update
go.mod 1

📂 go.mod

1 package will be updated to resolve vulnerabilities:

Package Name Current Version Updated Version
golang.org/x/crypto 0.41.0 0.52.0

Note

Medium Risk
Touches a security-sensitive dependency used for bcrypt password handling; risk is moderate because behavior should be unchanged but crypto upgrades warrant normal regression checks.

Overview
Bumps the direct golang.org/x/crypto dependency in go.mod from 0.41.0 to 0.52.0 to address reported vulnerabilities (Cycode-driven update). No application source changes are included in this diff.

That module is used in this repo for password hashing via golang.org/x/crypto/bcrypt (e.g. internal/api/crypto/hash.go), so the change is limited to the resolved crypto library version at build time.

Reviewed by Cursor Bugbot for commit 4a2eba8. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants