go-x-crypto, branch v0.47.0

go.mod: update golang.org/x dependencies

2026-01-12T15:56:02Z

Update golang.org/x dependencies to their latest tagged versions. Change-Id: I47041f06d6a0c92919eaac5d727cbc41551ed2e1 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/734461 Auto-Submit: Gopher Robot Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI Reviewed-by: Cherry Mui

chacha20poly1305: error out in fips140=only mode

2025-12-10T14:07:36Z

We don't guarantee fips140=only support in x/crypto, but chacha20poly1305 is special in that it's vendored into the standard library. We could wrap all the callsites, but it's more robust to just error out at construction time. Change-Id: I4b1e451bd250429c4c5c5b61c8b2141c6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/728480 Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Reviewed-by: David Chase Auto-Submit: Filippo Valsorda

go.mod: update golang.org/x dependencies

2025-12-08T18:34:26Z

Update golang.org/x dependencies to their latest tagged versions. Change-Id: I81158fb078bccce57d8d46cac0cb87e6c4f8cff9 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/728181 Reviewed-by: Dmitri Shuralyov Reviewed-by: David Chase Auto-Submit: Gopher Robot LUCI-TryBot-Result: Go LUCI

x509roots/fallback: update bundle

2025-12-03T20:57:53Z

This is an automated CL which updates the NSS root bundle. [git-generate] go generate ./x509roots Change-Id: Icde363f2fa61d1cb85552e57d4cae30b33ec96ed Reviewed-on: https://go-review.googlesource.com/c/crypto/+/723803 Auto-Submit: Gopher Robot LUCI-TryBot-Result: Go LUCI Reviewed-by: Roland Shoemaker Reviewed-by: Dmitri Shuralyov

ssh/agent: fix flaky test by ensuring a writeable home directory

2025-12-02T16:08:01Z

This fixes flakiness observed inside Google (b/465393996). Change-Id: Ic3decc3206b470cddf22c441b0cf92bb2bebb075 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/724002 Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI

go.mod: update golang.org/x dependencies

2025-11-19T19:55:48Z

Update golang.org/x dependencies to their latest tagged versions. Change-Id: I3923d98d88595230b12db261c48168b863dc2ce9 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/722000 LUCI-TryBot-Result: Go LUCI Reviewed-by: Roland Shoemaker Auto-Submit: Gopher Robot Reviewed-by: Neal Patel

ssh: curb GSSAPI DoS risk by limiting number of specified OIDs

2025-11-19T19:28:37Z

Previously, an attacker could specify an integer up to 0xFFFFFFFF that would directly allocate memory despite the observability of the rest of the payload. This change places a hard cap on the amount of mechanisms that can be specified and encoded in the payload. Additionally, it performs a small sanity check to deny payloads whose stated size is contradictory to the observed payload. Thank you to Jakub Ciolek for reporting this issue. Fixes CVE-2025-58181 Fixes golang/go#76363 Change-Id: I0307ab3e906a3f2ae763b5f9f0310f7073f84485 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/721961 Auto-Submit: Roland Shoemaker Reviewed-by: Damien Neil LUCI-TryBot-Result: Go LUCI

ssh/agent: prevent panic on malformed constraint

2025-11-19T19:28:34Z

An attacker could supply a malformed Constraint that would trigger a panic in a serving agent, effectively causing denial of service. Thank you to Jakub Ciolek for reporting this issue. Fixes CVE-2025-47914 Fixes golang/go#76364 Change-Id: I195bbc68b1560d4f04897722a6a653a7cbf086eb Reviewed-on: https://go-review.googlesource.com/c/crypto/+/721960 LUCI-TryBot-Result: Go LUCI Auto-Submit: Roland Shoemaker Reviewed-by: Damien Neil

acme/autocert: let automatic renewal work with short lifetime certs

2025-11-17T18:17:16Z

Fixes golang/go#64997 Fixes golang/go#36548 Change-Id: Idb7a426ad3bfa6ac3b796f4b466da6e3154f1ffa Reviewed-on: https://go-review.googlesource.com/c/crypto/+/719080 Reviewed-by: Roland Shoemaker Reviewed-by: Mark Freeman Reviewed-by: Daniel McCarney LUCI-TryBot-Result: Go LUCI

acme: pass context to request

2025-11-12T18:48:32Z

Fixes golang/go#30183 Change-Id: Ic02b34bc87b9465f5c05b2ef5bec157c58809a91 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/719002 Reviewed-by: Junyang Shao Reviewed-by: Daniel McCarney Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI