Release abctl with golang.org/x/crypto >= v0.52.0 for CVE-2026-46595
- Vorherrschende Sprache
- Python
- Sterne
- 22.1k
- Forks
- 5.4k
- Ø Merge
- 5 Std.
- Gemergte PRs (30 T.)
- 671
Beschreibung
### What happened?
The current `abctl` release, v0.30.4, embeds `golang.org/x/crypto v0.30.0`. The `main` branch currently
uses the same version.
CVE-2026-46595 affects `golang.org/x/crypto/ssh` versions before v0.52.0:
https://pkg.go.dev/vuln/GO-2026-5023
### What did you expect to happen?
Could `golang.org/x/crypto` be upgraded to v0.52.0 or later and a patched `abctl` release published?
### Abctl Version
```console
$ abctl version
v0.30.4
```
### Docker Version
```console
$ docker version
29.4.0```
### OS Version
```console
All
```
---
**Internal Tracking:** https://github.com/airbytehq/oncall/issues/13109
Beitragsleitfaden
Rechercherichtung
Locate the abctl Go dependency declaration on the main branch and confirm the current golang.org/x/crypto version. Then inspect the existing abctl release process. Done means the dependency is at least v0.52.0 and a patched abctl release is published.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- go
- Bereich
- cli, release, security
- Issue-Typ
- Bug
- Schwierigkeit
- 3/5
- Geschätzter Aufwand
- 1-2 Tage
- Aktivitätsstatus
- Ruhig
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 48/100