deps: bump golang.org/x/crypto to v0.55.0 in both modules - #1180
deps: bump golang.org/x/crypto to v0.55.0 in both modules#1180bitcoin-coder-bob wants to merge 2 commits into
Conversation
Clears CVE-2026-56854 (x/crypto/ssh authentication bypass) flagged by the Trivy scan on every branch since 2026-09-01. Indirect in the root module via macaroon-bakery, direct in arkd-wallet.
|
Warning Review limit reachedNext included review available in 9 minutes. View limit detailsLimit details: You’ve used all 2 included reviews currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: ⛔ Files ignored due to path filters (9)
📒 Files selected for processing (9)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The image also ships the ark CLI built from pkg/ark-cli, whose module graph still resolved v0.53.0, so the scan stayed red after the root and arkd-wallet bumps. Every module that lists x/crypto now pins v0.55.0.
arkana-ai-bot
left a comment
arkana-ai-bot
left a comment
There was a problem hiding this comment.
Arkana review — dependency bump, CVE-2026-56854
No protocol-critical paths touched; no VTXO/signing/forfeit/round/exit logic changed. CI is fully green (Build and Scan, check-go-sync, postgres/redis, unit tests).
What the change does
Bumps golang.org/x/crypto to v0.55.0 across all nine Go modules in this repo, with transitive minor bumps to x/net, x/sys, x/text, x/term, x/mod, x/sync, and x/tools. The go.sum hash lines are consistently paired (h1: + /go.mod h1:) for every changed entry.
Findings
[Cross-repo — go-sdk] /srv/arkana/repos/go-sdk/go.mod still carries golang.org/x/crypto v0.52.0, which falls below the fix threshold. The same Trivy CVE will flag the go-sdk image once scanning runs against it. A companion PR in the go-sdk repo is needed.
[pkg/arkd-wallet/go.mod — minor] github.com/btcsuite/btcd/address/v2 v2.0.0 was demoted from direct to indirect. The PR description says no code changes were made, so this looks like go mod tidy correcting a pre-existing stale marker rather than a silent removal of a used import. CI building cleanly is the main evidence here. If this module does directly import anything from btcd/address/v2, the tidy step would have left the direct marker; since it didn't, the import is transitive. Fine, but worth a quick grep to be sure: grep -r '"github.com/btcsuite/btcd/address/v2' pkg/arkd-wallet/.
[pkg/ark-lib/go.mod — minor] golang.org/x/sync was not bumped here (stays at v0.20.0) while every other module moved to v0.22.0. This is harmless — MVS will select the highest version needed across the build — but it leaves the go.mod entry stale relative to what is actually selected. A follow-up tidy pass on pkg/ark-lib would clean it up.
[CVE surface note] CVE-2026-56854 is in x/crypto/ssh (authentication bypass). The arkd modules that pull this in most directly are the root module (via macaroon-bakery) and pkg/macaroons. The bump is the right action regardless of whether SSH is exercised at runtime — leaving a known auth-bypass in the binary is not acceptable for a money-custody system.
Summary
Core fix is correct and complete for this repo. Blocking on the go-sdk companion PR is recommended before marking the CVE fully remediated.
arkana-ai-bot
left a comment
arkana-ai-bot
left a comment
There was a problem hiding this comment.
Arkana automated review — #1180
Dependency bump to clear CVE-2026-56854 (x/crypto/ssh authentication bypass). Scan picked up the gap because the ark-cli module still resolved v0.53.0 via its own module graph; this PR pins every module in the monorepo to v0.55.0, which is the right fix.
Checked:
- Root
go.mod/go.sum,pkg/ark-cli/go.mod/go.sum, and the remaining modules all consistently pinv0.55.0. No module is left behind. - Companion bumps (x/net, x/sys, x/sync, x/text, x/term, x/tools, x/mod) are consistent minor version increments — nothing unusual.
- No logic changes, only dependency graph updates.
Ready to merge. This is a security patch; expedite review.
3 participants
Bumps
golang.org/x/cryptoto v0.55.0 in every module that lists it.Why
The Trivy scan (Build and Scan) has been red on master and on every open branch since 2026-09-01, flagging CVE-2026-56854 in
golang.org/x/crypto/ssh(authentication bypass due to unenforced source-address restrictions), fixed in 0.55.0. The version did not change in any recent commit; the scan flipped when the vulnerability database picked up the newly published CVE.What
macaroon-bakery, bumped ingo.mod/go.sumpkg/arkd-wallet: direct dependency, bumped in itsgo.mod/go.sumpkg/ark-cli,pkg/ark-lib,pkg/client-lib,pkg/client-wallet,pkg/errors,pkg/kvdb,pkg/macaroons: bumped as well. The scanned image ships thearkCLI built frompkg/ark-cli, whose module graph still resolved v0.53.0 after the first two bumps, which is why the scan stayed red on the first commit. The rest are bumped so every module in the repo agrees on one version.go getalso movedx/text,x/toolsandx/termforward one minor each as transitive updatesNo code changes.
Test plan
go build ./...in every modulemake test-pkg(allpkg/*suites) and theinternal/interface/grpc/...suites, which reach x/cryptogo mod tidyleaves no drift, which is whatcheck-go-syncverifiesOnce merged, #1160, #1161, #1162 and #1174 each need a master merge to clear the same check.