build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 in /secmem-crypto - #51
Conversation
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.54.0 to 0.55.0. - [Commits](golang/crypto@v0.54.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.55.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
… move together Dependency changes are release-relevant in this repo — secmem-crypto/v0.3.1 was a dependency-only release with its own entry — because a require change in secmem-crypto raises the floor for everyone importing it. Two x/crypto bumps were landing with nothing in Unreleased. Also records the coupling, since it is the kind of thing that is obvious only while you are looking at it: examples pins secmem-crypto with a replace, but a replace does not exempt the require line from minimum version selection, so bumping only secmem-crypto makes MVS select 0.55.0 for examples while its go.mod still asks for 0.54.0. CI runs readonly, so that is a hard error before any package loads — which is exactly how #51 failed on its own. Maintenance rather than a security fix: the vuln job was green against 0.54.0.
|
Landed on This PR failed its own Landing #52 first resolves it; the train verified both together (22/22 green). Rebased locally so the commit carries the maintainer's SSH signature, with dependabot preserved as author — hence the different SHA and the manual close. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps golang.org/x/crypto from 0.54.0 to 0.55.0.
Commits
f44d03dgo.mod: update golang.org/x dependencies5ed4944crypto/internal/poly1305: provide optimised assembly for riscv64b07833cssh: return window credit for discarded extended datad701c51acme: fix nil pointer dereference in pebble test error reporting999d053ssh: fix parsing of GSSAPI payloads offering multiple mechanisms90f76b8ssh: reject certificate signature keys before recursingb53964assh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs626e40fssh: drain stderr on forwarded TCP and Unix channels31914c6x509roots/fallback: update bundlef2135b8all: clean up minor issues found by staticcheckDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)