Skip to content

fix(deps): bump the external group across 1 directory with 2 updates#3649

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/lib/ocrypto/external-9a8ab3537f
Open

fix(deps): bump the external group across 1 directory with 2 updates#3649
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/lib/ocrypto/external-9a8ab3537f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the external group with 2 updates in the /lib/ocrypto directory: github.com/cloudflare/circl and golang.org/x/crypto.

Updates github.com/cloudflare/circl from 1.6.3 to 1.6.4

Release notes

Sourced from github.com/cloudflare/circl's releases.

CIRCL v1.6.4

What's Changed

New Contributors

Full Changelog: cloudflare/circl@v1.6.3...v1.6.4

Commits
  • 901199c Release CIRCL v1.6.4
  • 5e37b40 abe/cpabe/tkn20: reject circuits with invalid topologies.
  • 4ea7e90 abe/cpabe/tkn20: handle malformed ciphertext header.
  • ae0b5c4 abe/cpabe/tkn20: enforce wire count matches policy.
  • 9547f48 abe/cpabe/tkn20: handle short ciphertexts as errors.
  • bfa7605 abe/cpabe/tkn20: reject ciphertexts with trailing data.
  • bdde3c7 abe/cpabe/tkn20: bound recursion depth when parsing policies.
  • 03204f3 ecc/bls12381: check input length for infinity encoding in SetBytes. (#618)
  • e9bd81b Add AGENTS.md and REVIEW.md for AI agent and human reviewer guidance
  • 02ab708 oprf: reject identity element as public key.
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits
  • 45460e0 go.mod: update golang.org/x dependencies
  • d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
  • e2ffffe ssh: reject incomplete gssapi-with-mic configurations
  • 60e158a ssh/test: isolate CLI tests from user SSH config and agent
  • 1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
  • 3872a2b ssh/knownhosts: verify declared key type matches decoded key
  • 9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
  • 8f405a4 ssh: validate ECDSA curve matches expected algorithm
  • bb41b3d ssh: improve DH GEX group selection using PreferredBits
  • e04e721 ssh/agent: validate ed25519 private key length in Add
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 22, 2026
@dependabot dependabot Bot requested a review from a team as a code owner June 22, 2026 17:53
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 22, 2026
@dependabot dependabot Bot requested a review from a team as a code owner June 22, 2026 17:53
@dependabot dependabot Bot added the go Pull requests that update Go code label Jun 22, 2026
@github-actions

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 254.763178ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 88.816922ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 619.289716ms
Throughput 161.48 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 43.620146992s
Average Latency 434.29042ms
Throughput 114.63 requests/second

@dependabot dependabot Bot force-pushed the dependabot/go_modules/lib/ocrypto/external-9a8ab3537f branch from 71e8ccd to de39cb9 Compare June 23, 2026 17:53
@github-actions

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 182.025186ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 98.490659ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 450.460189ms
Throughput 222.00 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 44.705224392s
Average Latency 445.635857ms
Throughput 111.84 requests/second

Bumps the external group with 2 updates in the /lib/ocrypto directory: [github.com/cloudflare/circl](https://github.com/cloudflare/circl) and [golang.org/x/crypto](https://github.com/golang/crypto).


Updates `github.com/cloudflare/circl` from 1.6.3 to 1.6.4
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](cloudflare/circl@v1.6.3...v1.6.4)

Updates `golang.org/x/crypto` from 0.52.0 to 0.53.0
- [Commits](golang/crypto@v0.52.0...v0.53.0)

---
updated-dependencies:
- dependency-name: github.com/cloudflare/circl
  dependency-version: 1.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external
- dependency-name: golang.org/x/crypto
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: external
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/go_modules/lib/ocrypto/external-9a8ab3537f branch from de39cb9 to d4aa37b Compare June 24, 2026 17:53
@github-actions

Copy link
Copy Markdown
Contributor
Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 187.060599ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 110.443015ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 430.165241ms
Throughput 232.47 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 45.053446808s
Average Latency 448.797789ms
Throughput 110.98 requests/second

@github-actions

Copy link
Copy Markdown
Contributor

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

  • examples
  • otdfctl
  • sdk
  • service
  • lib/fixtures
  • tests-bdd

See the workflow run for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp:lib:ocrypto dependencies Pull requests that update a dependency file go Pull requests that update Go code size/s

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants