chore(deps): bump x/crypto and grpc for the SSH deadlock and DATA frame advisories - #7024
Merged
Conversation
…deadlocks GO-2026-6354 and GO-2026-6355 both let a peer deadlock an SSH connection through the channel mux, and both are fixed in v0.56.0. In GO-2026-6354 a channel registered in the mux's chanList is not usable until it is established, but handlePacket still delivers to it: flooding the channel's incomingRequests before the open confirmation blocks the mux loop and takes the whole connection with it. The fix adds an atomic established state and drops every packet other than the open confirmation or failure until it is set. In GO-2026-6355 the same loop buffers and blocks on messages outside RFC 4254 once the channel is established. The fix handles the RFC's channel messages, treats global requests explicitly, and tears the connection down on anything else instead of blocking. govulncheck reports both as reachable here through ssh.NewServerConn and channel.handlePacket, so the SSH listener is exposed to an unauthenticated peer, and through ssh.Dial and ssh.NewClientConn on the agent side. Every module in the workspace carries the dependency, so all five move together rather than leaving the listener and the agent on different versions of the mux.
GHSA-vp52-pcj8-j9qc: a gRPC-Go server accumulates fragmented HTTP/2 DATA frames without bounding what a single stream may hold, so a peer sending many small fragments can exhaust the heap. Fixed in 1.83.1; the tests module was still on 1.82.1. The gateway already moved in "deps: bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /gateway", which left this module as the last one behind. It reaches grpc only through testcontainers, so nothing shipped is affected -- this closes the alert rather than a hole.
|
Claude finished @otavio's task in 57s —— View job Code Review CompleteReviewed 10 files across code quality, security, testing, language patterns, and architecture — no new issues found. The code looks good as-is. This is a clean, source-code-free dependency bump. Verified:
One out-of-scope note: To request another review round, comment --- • |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Moves
golang.org/x/cryptoto v0.56.0 across all five modules andgoogle.golang.org/grpcto1.83.1 in
tests/, clearing three advisories. No behaviour change beyond the upstream fixes.Why
GO-2026-6354andGO-2026-6355both let a peer deadlock an SSH connection through the channelmux. govulncheck reports them as reachable here through
ssh.NewServerConnandchannel.handlePacket, so the SSH listener is exposed to an unauthenticated peer, and throughssh.Dial/ssh.NewClientConnon the agent side. These are code scanning alerts 304 and 305.GHSA-vp52-pcj8-j9qc(high) is heap exhaustion from unbounded fragmented HTTP/2 DATA frames.gateway/already moved in "deps: bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /gateway",which left
tests/as the last module behind. This is Dependabot alert 685.Changes
agent/,server/,tests/andgateway/. All fivecarry the dependency, so they move together rather than leaving the listener and the agent on
different versions of the channel mux.
tests/. Reached only through testcontainers, so nothing shipped isaffected — this closes the alert rather than a hole.
Testing
govulncheck after the bump reports 0 vulnerabilities for root,
server/andgateway/;GO-2026-6354/6355are gone from every module. Full test suites pass across root,server/,agent/andgateway/, plusgo vet -tags dockerontests/.Two environment notes for anyone reproducing locally, both of which look like real failures but
are not:
--network host, otherwise the Ryuk reaper is unreachable at172.17.0.1from a nested container andpkg/worker/asynqstalls 60s then fails.shellhub-server-1bakes the rootgo.modinto the image while bind-mountinggo.sum, soroot-module builds there report spurious "missing go.sum entry" errors. Use a
workspace-mounted one-off container.
GO-2026-4883/4887still show onagent/andtests/. Those are the knowndocker/dockerpair with no fix on that module path, unaffected by this PR.