fix(deps): update x/crypto for SSH DoS fixes - #6847
Conversation
✅MegaLinter analysis: Success✅ Linters with no issuesactionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint Notices
See detailed reports in MegaLinter artifacts
|
@coderabbitai review |
|
✅ Action performedReview finished.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Team Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (2)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (5)
🔇 Additional comments (2)
📝 WalkthroughWalkthroughUpdates Merge Risk: ⚪ Minimal · up to The dependency update moves both Go modules to the fixed x/crypto version, with supplied validation showing the vulnerability scan, tests, build, and required checks passing. No current merge-blocking risk remains. Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
Full details: Linked Issues checkExplanation The PR upgrades golang.org/x/crypto to v0.56.0 in both modules, which addresses the linked SSH DoS requirements. However, tidy dependency results and checksum changes cannot be independently verified because go.sum and desktop/go.sum were excluded by the !**/*.sum path filter. Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.) ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Warning Tools execution failed with the following error: Failed to run tools: Ping-pong health check failed Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Refutation for the ancillary same-head review finding:
The reported same-head ancillary concerns are therefore resolved without a file change. |
@coderabbitai full review |
|
✅ Action performedFull review finished. |
Refutation for the updated same-head ancillary finding:
The requested full-suite, tidy, and unallowlisted vulnerability evidence is now linked directly; the reported ancillary concerns are resolved without a file change. |
@coderabbitai full review |
|
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Readiness evaluation for
All genuine-readiness conditions are satisfied at this exact head. |
Diagnosis of the
|
Re-triggered the missing
|
| Signal | State |
|---|---|
CI - Required Checks (the only required status check) |
✅ success |
Analyze (javascript-typescript), Analyze (actions) |
✅ success |
| Unresolved review threads | 0 of 0 (complete read, fetched == totalCount) |
| Green review at head | ✅ Codex, Reviewed commit: c7f9d393cb == headRefOid[0:10] |
| Conflict with base | none — MERGEABLE, behind_by=0 |
Both re-run paths are refused. rerun and rerun-failed-jobs on run 33689878970 each return
403 This workflow run cannot be retried — it is GitHub-managed (event: dynamic,
path: dynamic/github-code-scanning/codeql), so there is no workflow file to fix and no re-run button.
So I closed and reopened the PR. CodeQL default setup runs on pull_request, and reopened is
one of its trigger types, so this re-dispatches the analysis without a new commit — which matters,
because a new head would have staled the Codex green and cost another metered review round for a
4-line go.sum change. Head is unchanged at c7f9d393cbb8; the reopen re-fired the six
pull_request workflows at 01:07Z.
One correction to the earlier comment
It read Analyze (go) as green on main and concluded the failure was not base-inherited. The
first half is true of the newest run only — over main's last 8 CodeQL runs, 3 failed, and I
pulled the log of one of them (33671294945, commit c53ef329, unrelated to this PR) as a positive
control: it carries the identical wailsapp/wails … could not import C (no metadata for C)
signature. So this lane flaps on main too, roughly half the time.
That does not change the conclusion for this PR — the change is 4 lines of go.mod/go.sum and
cannot affect cgo extraction — but it does mean a re-trigger is a coin flip rather than a certainty,
and that the flapping itself is a real defect worth fixing at the root (buildless Go analysis via
advanced setup would remove autobuild, the 19-minute extraction, and the cgo errors together). I am
filing that separately rather than widening this hotfix.
Why this is worth the effort: main is red right now on CI - KSail →
🛡️ Vulnerability Scan, with ##[error]Reachable vulnerabilities not accepted in ./.govulncheck-allow.txt: GO-2026-6354 GO-2026-6355 — precisely the two advisories this PR fixes.
The same job is ✅ on this branch. This is the fix for live rung-0 breakage.
The `Require code scanning results` ruleset blocks this PR because the `go` CodeQL configuration produced no analysis for c7f9d39 — the gate reports `neutral: 1 configuration not found` after the 22:20Z run died in Autobuild. That analysis is GitHub-managed (`event: dynamic`, `path: dynamic/github-code-scanning/codeql`), so it has no workflow file and both `rerun` and `rerun-failed-jobs` return 403. Closing and reopening the PR re-fires the repository's own pull_request workflows but NOT the managed configuration (measured, recorded on #6767), so a new head commit is the only remaining way to obtain the analysis. This commit changes no files. It exists solely to produce a head that CodeQL will analyse, so the x/crypto fix for GO-2026-6354 / GO-2026-6355 can land — `main` is currently red on that vulnerability scan. Refs #6767 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The head moved to @coderabbitai review |
|
|
The plain Escaping the incremental wedge with a full review so this head carries its own green rather than @coderabbitai full review |
|
✅ Action performedFull review finished. |
State at 2026-09-03T02:2xZ — one transient away from mergeableDriving this from the Claude lane (the branch is Pentad at head
The green review is secured — and how, because it is not where you would look
Getting there needed the wedge escape: the plain The one failure is a transient, and it is not this PR's fault
I filed that as its own defect — #6848 — because a real user upgrading a single-node cluster hits Next actionOnce run 33703166551 settles, Landing this also clears #6839, which fails only the same |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="devantler-tech/ksail"
pr="6847"
echo "== Pull request =="
gh pr view "$pr" --repo "$repo" --json number,headRefOid,mergeable,mergeStateStatus,isDraft,state,statusCheckRollup \
--jq '{
number,
headRefOid,
mergeable,
mergeStateStatus,
isDraft,
state,
checks: [.statusCheckRollup[] | {
name: (.name // .context),
status: .status,
conclusion: .conclusion,
detailsUrl: (.detailsUrl // .targetUrl)
}]
}'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
echo "== Reviews at head $head =="
gh api "repos/$repo/pulls/$pr/reviews?per_page=100" \
--jq --arg head "$head" '[.[] | select(.commit_id == $head) | {user: .user.login, state: .state, submitted_at: .submitted_at, body: .body}]'
echo "== Open review threads =="
gh api graphql -F owner="devantler-tech" -F name="ksail" -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
totalCount
nodes { isResolved }
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads | {totalCount, unresolved: ([.nodes[] | select(.isResolved == false)] | length)}'Length of output: 17096 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="devantler-tech/ksail"
pr="6847"
head="d6643e20ad28bab3847940bf18c6a310847e6c03"
echo "== Submitted reviews at the current head =="
gh api "repos/$repo/pulls/$pr/reviews?per_page=100" \
--jq "[.[] | select(.commit_id == \"$head\") | {user: .user.login, state, submitted_at, id}]"
echo "== Review-thread resolution state =="
gh api graphql \
-F owner="devantler-tech" \
-F name="ksail" \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
totalCount
pageInfo { hasNextPage }
nodes { isResolved }
}
}
}
}' \
--jq '.data.repository.pullRequest.reviewThreads | {
totalCount,
hasNextPage: .pageInfo.hasNextPage,
unresolved: ([.nodes[] | select(.isResolved == false)] | length)
}'Length of output: 1195
The PR remains blocked until a successful rerun replaces the failed system-test result. You are interacting with an AI system. |
Correction to my previous comment, and the transient re-run is awayRe-run dispatched. Run 33703166551 Correction — I overstated the knock-on effect on #6839. I wrote that landing this "also clears
So the accurate statement is: #6839 is unblocked by this merge plus a rebase, and if Dependabot |
1 participant
Why
New Go advisories GO-2026-6354 and GO-2026-6355 are reachable through KSail SSH paths on main, which makes the vulnerability gate fail.
What
Update golang.org/x/crypto from v0.55.0 to the fixed v0.56.0 in both the root and desktop modules, with only the corresponding checksums changed.
Validation
Fixes #6846