[AV-142878] Bump golang.org/x/*, grpc and protobuf to clear critical advisories

[allabalakrishna9]

Jira

• AV-142878 — consolidated ticket: full CVE list and reachability analysis

Superseded tickets (all closed as duplicates of AV-142878)

Ticket	Module	AutoFix PR (closed)
AV-142867	golang.org/x/crypto	#18
AV-142868	golang.org/x/net	#19
AV-142872	google.golang.org/grpc	#21

Description

Consolidates three Aikido AutoFix PRs — #18 (x/crypto), #19 (x/net) and #21 (grpc) — and supersedes all of them.

None of them could be merged together safely. Each edits go.mod/go.sum, and each was generated against main with no knowledge of the others, so whichever merged last would silently rewrite the earlier ones:

Module	#18	#19	#21	Worst-case if merged after the others
x/crypto	v0.52.0 (4 adv.)	v0.51.0 (30 adv.)	v0.46.0 (30 adv.)	+27 re-introduced
x/net	—	v0.55.0 (1 adv.)	v0.48.0 (9 adv.)	+9 re-introduced
go directive	1.25.0	1.25.0	1.24.0	downgrade

What this does

Module	Before	After	Known advisories
golang.org/x/net	v0.17.0	v0.58.0	18 → 0
golang.org/x/crypto	v0.17.0	v0.55.0	39 → 3
google.golang.org/grpc	v1.56.3	v1.83.2	5 → 0
google.golang.org/protobuf	v1.30.0	v1.36.12	2 → 0
golang.org/x/sys	v0.15.0	v0.47.0
golang.org/x/text	v0.14.0	v0.41.0
github.com/golang/protobuf	v1.5.3	v1.5.4
github.com/google/uuid	v1.3.0	v1.6.0

Why the Go directive and Dockerfile move

x/net@v0.58.0, x/crypto@v0.55.0 and grpc@v1.83.2 all declare go 1.25.0. The directive moves 1.21.3 → 1.25.0 and the builder stage moves golang:1.21 → golang:1.25. Forced by the modules, not discretionary — pinning it back fails with module requires go >= 1.25.0.

Version choices that differ from the AutoFix PRs

grpc v1.83.2, not v1.79.3 (#21's target). v1.79.3 still carries 3 advisories, including GHSA-vp52-pcj8-j9qc (heap exhaustion via HTTP/2 DATA frame fragmentation) and the xDS RBAC issues. v1.83.2 has none, and requires exactly what this branch already sets.

x/crypto v0.55.0, not v0.56.0. v0.56.0 requires go 1.26.0, released days ago. The only advisories it clears beyond v0.55.0 are two DoS issues in x/crypto/ssh and the openpgp-unmaintained notice — and neither package is in this module's build graph (go list -deps ./... resolves only cryptobyte, chacha20, poly1305, blake2b). No reachable benefit for a brand-new toolchain. Easy to revisit later.

Reachability

Verified with govulncheck ./... on both main and this branch — symbol-level call-graph analysis, which supersedes the package-level estimate this section previously carried (that estimate had the grpc and idna rows inverted).

	main	this PR
Reachable from this code (symbol level)	3	0
Imported, vulnerable symbols not called	4	0
Required modules only	34	3

The three reachable on main, all fixed here:

Go vuln	Alias	Module	Issue	Fixed in
GO-2026-4762	CVE-2026-33186	grpc	Authz bypass via missing leading slash in HTTP/2 :path	1.79.3
GO-2026-6061	GHSA-hrxh-6v49-42gf	grpc	xDS RBAC engine + HTTP/2 transport server	1.82.1
GO-2024-2687	CVE-2023-45288	x/net	HTTP/2 CONTINUATION flood	0.23.0

Two of these (GO-2026-6061, CVE-2023-45288) were not in any Aikido ticket, and GO-2026-6061 is not fixed by the grpc 1.79.3 that #21 proposed — it would have left a reachable vulnerability in place. That is the concrete reason for v1.83.2.

The x/net idna issue Aikido did report (CVE-2026-39821) is imported but its vulnerable symbols are not called from this code. All 10 x/crypto advisories are module-level only: x/crypto/ssh is not in the build graph. Residual after this PR: 3 module-level x/crypto/ssh items, none compiled in. Full breakdown in AV-142878.

Testing

• go build ./... — clean
• go mod verify — all modules verified; go mod tidy — idempotent
• govulncheck ./... — 0 reachable, 0 imported, 3 module-level (see Reachability)
• docker build --target builder on golang:1.25 — succeeds; binary reports go1.25.14
• go test -short ./... — TestDriver fails identically on main (t.Fatal when ORG_ID is unset, no skip gate); pre-existing integration test, not caused by this change
• go vet ./... — one pre-existing issue only: httputils.go:425 has json: "cursor" with a stray space, so the tag is silently ignored. Untouched here; worth a separate fix.

No vendor/ directory and no CI beyond default-setup CodeQL, so go.mod/go.sum are the complete dependency surface.

Note

main reports 25 Dependabot advisories (9 critical, 5 high). This PR covers the golang.org/x/*, grpc and protobuf share; the remainder is untouched.

[Copilot]

🔵 Needs a closer look

It includes a Go toolchain version jump (and corresponding build image change) without CI coverage in-repo, so it warrants a final human verification in the intended build/release environment.

Pull request overview

This PR upgrades several golang.org/x/* dependencies to address security advisories, and updates the module’s Go version and build image to meet the new minimum toolchain requirement imposed by those dependencies.

Changes:

• Bump golang.org/x/net to v0.58.0 and golang.org/x/crypto to v0.55.0 (plus related x/sys / x/text upgrades).
• Update the module go directive from 1.21.3 to 1.25.0 to satisfy upstream module requirements.
• Update the Docker build stage from golang:1.21 to golang:1.25 to align the containerized build with the new Go minimum.

File summaries

File	Description
go.mod	Updates Go toolchain directive and bumps indirect golang.org/x/* versions.
go.sum	Refreshes module checksums to match the upgraded golang.org/x/* dependencies.
Dockerfile	Moves the builder image to Go 1.25 to support the new go.mod minimum version.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

It includes a major toolchain bump and large transitive dependency upgrades without CI coverage to validate runtime behavior beyond local builds.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

Dockerfile:2

• FROM golang:1.25 is a mutable tag, so builds may stop being reproducible (or pick up unexpected toolchain changes) as the upstream image is updated. Consider pinning to a specific patch version and/or an image digest per your supply-chain policy.

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[allabalakrishna9]

Pre-merge double-check of this PR against the three closed AutoFix PRs (#18, #19, #21):

Completeness / no downgrades

• Every module bumped in [AV-142867] Fix critical issue in x/crypto via minor version upgrade from 0.17.0 to 0.52.0 #18, [AV-142868] Fix critical issue in x/net via minor version upgrade from 0.17.0 to 0.55.0 #19 or [AV-142872] Fix critical issue in google.golang.org/grpc via minor version upgrade from 1.56.3 to 1.79.3 #21 is present here at an equal or higher version (16 of 16 checked, including an x/net bump to v0.54.0 in [AV-142867] Fix critical issue in x/crypto via minor version upgrade from 0.17.0 to 0.52.0 #18).
• Every module here is ≥ main. 0 downgrades, 0 removals. No toolchain directive was introduced.

Integrity

• go mod verify: all modules verified. go mod tidy: idempotent.
• go build ./...: clean. go vet: only the pre-existing httputils.go:425 struct-tag issue.

Docker

• docker build --target builder on golang:1.25 succeeds; the produced plugin binary reports go1.25.14. (Buildkit notes a pre-existing lint nit: as vs FROM casing on line 2.)

Tests

• go test -short ./...: TestDriver fails with orgId cannot be empty — identically on main. It t.Fatals when ORG_ID is unset and has no skip gate. Pre-existing, unrelated.

govulncheck (symbol-level)

• main: 3 reachable (GO-2026-4762 / CVE-2026-33186 grpc :path; GO-2026-6061 grpc xDS+HTTP/2, fixed only in 1.82.1; GO-2024-2687 / CVE-2023-45288 x/net CONTINUATION flood), 4 imported-not-called, 34 module-only.
• this branch: 0 reachable, 0 imported, 3 module-only (x/crypto/ssh, not compiled in).

Two of the three reachable vulns on main were never in an Aikido ticket, and one of them is not fixed by the grpc 1.79.3 that #21 proposed. The PR description's Reachability section has been corrected accordingly — the earlier package-level estimate had the grpc and idna rows inverted.