chore(deps): bump golang.org/x/crypto to 0.35.0 (4 CRIT + 4 HIGH CVE fixes)

[KooshaPari]

Summary

Bumps golang.org/x/crypto from v0.31.0 to v0.35.0 across all 4 Go modules in the repo.

v0.35.0 is the first patched version covering both:

• CRIT GHSA-v778-237x-gjrc (alerts Bump the cargo group across 1 directory with 4 updates #16, chore(deps): add dependabot.yml covering cargo, gomod, npm, github-actions #20, chore(hygiene): bootstrap SECURITY, CHANGELOG, CONTRIBUTING, CODEOWNERS #22, ci(security): bootstrap CodeQL + trufflehog per audit #129 #24) — first patched 0.31.0
• HIGH GHSA-hcg3-q754-cr77 (alerts chore(ci): add Go CI workflow and smoke test #18, chore(license): set SPDX license metadata to match Apache-2.0 LICENSE #21, ci(security): bootstrap CodeQL + trufflehog per audit #129 #23, chore(deps): bump 10 npm packages (23 HIGH CVE fixes) #25) — first patched 0.35.0

The prior 0.31.0 bump only addressed the critical alerts; this supersedes it to also close the 4 high-severity alerts in a single bump.

Manifests touched

• backend/byteport/go.mod
• backend/nvms/go.mod
• backend/nvms/Demonstrator/go.mod
• backend/nvms/Provisioner/go.mod

Verification

• go build ./... exits 0 in each module (pre-existing fermyon SDK export-comment warning is unrelated, not fatal).

Test plan

• go build ./... in all four modules
• Confirm Dependabot re-evaluates and closes alerts Bump the cargo group across 1 directory with 4 updates #16, chore(ci): add Go CI workflow and smoke test #18, chore(deps): add dependabot.yml covering cargo, gomod, npm, github-actions #20, chore(license): set SPDX license metadata to match Apache-2.0 LICENSE #21, chore(hygiene): bootstrap SECURITY, CHANGELOG, CONTRIBUTING, CODEOWNERS #22, ci(security): bootstrap CodeQL + trufflehog per audit #129 #23, ci(security): bootstrap CodeQL + trufflehog per audit #129 #24, chore(deps): bump 10 npm packages (23 HIGH CVE fixes) #25 post-merge

Closes Dependabot alerts: #16 #18 #20 #21 #22 #23 #24 #25

---

Note

Medium Risk
Primarily dependency and Go toolchain version bumps; risk is limited but could surface build/runtime compatibility issues across the multiple backend modules due to updated x/crypto and related transitive packages.

Overview
Upgrades backend Go dependencies to address security/maintenance updates. backend/byteport now uses golang.org/x/crypto v0.35.0 (direct) and refreshes transitive versions (golang.org/x/sys v0.30.0, golang.org/x/text v0.22.0) with updated go.sum.

Aligns the nvms modules on newer Go versions/toolchain. backend/nvms, nvms/Demonstrator, and nvms/Provisioner bump go to 1.23.0 and toolchain to go1.23.4, and update indirect deps (x/crypto to v0.35.0, x/sys to v0.30.0); Provisioner also drops some no-longer-needed indirect entries from its module files.

^{Reviewed by Cursor Bugbot for commit 4a25a1c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (10 files)

• backend/byteport/go.mod
• backend/byteport/go.sum
• backend/nvms/Demonstrator/go.mod
• backend/nvms/Demonstrator/go.sum
• backend/nvms/Provisioner/go.mod
• backend/nvms/Provisioner/go.sum
• backend/nvms/go.mod
• backend/nvms/go.sum

---

_{Reviewed by nemotron-3-super-120b-a12b-20230311:free · 2,223,367 tokens}

[codeant-ai]

Suggestion: golang.org/x/crypto v0.31.0 is still in a known vulnerable range (the HIGH advisory mentioned in the PR notes affects versions < 0.35.0). Pinning to this version leaves the module exposed; upgrade to a non-vulnerable release (>= v0.35.0, ideally latest) to fully remediate known crypto CVEs. [security]

Severity Level: Critical 🚨

- ⚠️ Provisioner Spin HTTP component uses vulnerable x/crypto dependency.
- ⚠️ Handles decrypted user Git access tokens and repository archives.
- ⚠️ Dependabot HIGH advisory for x/crypto remains unresolved here.

Steps of Reproduction ✅

1. Open the Provisioner module manifest at `backend/nvms/Provisioner/go.mod` and observe
line 18: `golang.org/x/crypto v0.31.0 // indirect`, which pins the module to version
0.31.0 (confirmed via Read of this file).

2. From the `backend/nvms/Provisioner` directory, running `go list -m golang.org/x/crypto`
(or inspecting `go.sum`) would resolve `golang.org/x/crypto` to v0.31.0 for this Spin HTTP
component, meaning all its transitive users in this module graph link against that
vulnerable version.

3. Follow the Provisioner's main entrypoint in `backend/nvms/Provisioner/main.go`: the
`init()` function at ~line 152 registers a Spin HTTP handler that reads a request body
into a `models.Project`, then calls `lib.DecryptSecret(project.User.Git.Token)` at line
172 to decrypt a user's Git access token and then downloads and processes a repository
ZIP.

4. Because this Provisioner component handles sensitive user secrets and repository
content while its module graph still includes `golang.org/x/crypto` v0.31.0 (a version
explicitly called out in the PR description as remaining within the HIGH-severity advisory
range `< v0.35.0`), any transitive dependency that relies on affected `x/crypto`
primitives will continue to operate with a known-vulnerable crypto implementation until
the version is raised to `>= v0.35.0`.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** backend/nvms/Provisioner/go.mod
**Line:** 18:18
**Comment:**
	*Security: `golang.org/x/crypto v0.31.0` is still in a known vulnerable range (the HIGH advisory mentioned in the PR notes affects versions `< 0.35.0`). Pinning to this version leaves the module exposed; upgrade to a non-vulnerable release (>= `v0.35.0`, ideally latest) to fully remediate known crypto CVEs.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​golang.org/​x/​crypto@​v0.29.0 ⏵ v0.35.0	+1	+73

View full report

[kilo-code-bot]

Incremental dependency updates reviewed. No issues found. Updates are appropriate and pose no risks.