🔒 Dependency Dashboard #9
Labels
No labels
dependabork
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Headscracher/planka_discord_bridge#9
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
🔒 Dependency Dashboard (3)
3 unknown
golang.org/x/crypto 0.55.0 — The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.
If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.
affected
>=0· found ingo.modhttps://go.dev/issue/44226
golang.org/x/crypto 0.55.0 — Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.
Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
affected
>=0 <0.56.0· found ingo.modhttps://go.dev/issue/81316 · https://go.dev/cl/826504 · https://groups.google.com/g/golang-announce/c/1y3fb2np35U
golang.org/x/crypto 0.55.0 — Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.
Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
affected
>=0 <0.56.0· found ingo.modhttps://go.dev/issue/81317 · https://go.dev/cl/826524 · https://groups.google.com/g/golang-announce/c/1y3fb2np35U
Scanned 1 lockfile(s) · 2026-09-02 19:35 UTC · dependabork