8877a1460cbc6bc1ea2a1725efe1f33fc9687b35Author Kieran Klukas <kieran@dunkirk.sh> Committer Kieran Klukas <kieran@dunkirk.sh> Date 2026-10-05 15:00 UTC Message fix(deps): update Go and x/crypto to clear reported vulnerabilities
The vulnerability scan in CI started failing on known issues in the SSH
library (connection deadlocks that allow denial of service, and a
certificate source-address restriction that was not enforced) and in
the Go standard library (TLS, HTTP, URL, XML and ASN.1 parsing). Go
1.26.6 and golang.org/x/crypto v0.56.0 contain the fixes.
💘 Generated with Crush
Assisted-by: Crush:claude-opus-5-5
Diff 1 diff --git a/go.mod b/go.mod
2 index dddf8b6612effec17ba6537b7148f870f7aa5434..2856f116554ec5e8f1bbe8d13038aea593e605ad 100644
3 --- a/go.mod
4 +++ b/go.mod
5 @@ -1,6 +1,6 @@
6 module github.com/charmbracelet/soft-serve
7
8 -go 1.26.5
9 +go 1.26.6
10
11 require (
12 charm.land/bubbles/v2 v2.1.1
13 @@ -40,7 +40,7 @@ require (
14 github.com/sergi/go-diff v1.4.0
15 github.com/spf13/cobra v1.10.2
16 go.uber.org/automaxprocs v1.6.0
17 - golang.org/x/crypto v0.54.0
18 + golang.org/x/crypto v0.56.0
19 golang.org/x/sync v0.22.0
20 gopkg.in/yaml.v3 v3.0.1
21 modernc.org/sqlite v1.56.0
22 @@ -93,7 +93,7 @@ require (
23 golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 // indirect
24 golang.org/x/net v0.57.0 // indirect
25 golang.org/x/sys v0.47.0 // indirect
26 - golang.org/x/text v0.40.0 // indirect
27 + golang.org/x/text v0.41.0 // indirect
28 golang.org/x/tools v0.48.0 // indirect
29 google.golang.org/protobuf v1.36.11 // indirect
30 gopkg.in/warnings.v0 v0.1.2 // indirect
31 diff --git a/go.sum b/go.sum
32 index 2e242c8118a9ae7f3656775af88e92b865626246..6a0f657ed285293473d20c8d6977e3cea65850e1 100644
33 --- a/go.sum
34 +++ b/go.sum
35 @@ -230,8 +230,8 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
36 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
37 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
38 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
39 -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
40 -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
41 +golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
42 +golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
43 golang.org/x/exp v0.0.0-20260727155853-b88d891fe743 h1:ex206bKw+v3K0dm3andkrIF+ijyQKJG1pLgwQ2PYdQM=
44 golang.org/x/exp v0.0.0-20260727155853-b88d891fe743/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
45 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
46 @@ -274,8 +274,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
47 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
48 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
49 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
50 -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
51 -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
52 +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
53 +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
54 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
55 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
56 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=