CVE-2026-46595: patch golang.org/x/crypto in proxy

[celdrake]

CVE Fix

Vulnerabilities Addressed

CVE ID	Severity	Package	Old Version	New Version
CVE-2026-46595	Critical	golang.org/x/crypto	v0.51.0	v0.52.0

Strategy Justification

For each CVE, the following strategies were attempted in order:

CVE-2026-46595 — golang.org/x/crypto

#	Strategy	Result	Details
1	Direct update (minor)	Success	go get golang.org/x/crypto@v0.52.0 in proxy/
2	Transitive update	Skipped	Resolved by Strategy 1
3	Override/pin	Skipped	Resolved by Strategy 1
4	Major version update	Skipped	Resolved by Strategy 1

Validation

• Dependencies: Updated to v0.52.0 (go list -m golang.org/x/crypto)
• Build: cd proxy && go build ./... passes
• Tests: auth/redirect_test.go fails on main without this change (pre-existing); other packages pass

Rollback

To revert this change:

git revert <commit-sha>

Fixes https://github.com/flightctl/flightctl-ui/security/dependabot/146

• proxy/: Updated indirect dependency golang.org/x/crypto from v0.51.0 to v0.52.0 to address CVE-2026-46595.
• No changes to shared UI components, platform-specific apps, packaging, container builds, E2E tests, or CI configuration.
• Dependency update, build, and package validation completed. auth/redirect_test.go remains a pre-existing failure on the main branch.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 8d5196e2-5fd5-4b8f-b8ea-9e820820a31f

📥 Commits

Reviewing files that changed from the base of the PR and between cf3df8e and ba0c6a9.

⛔ Files ignored due to path filters (1)

• proxy/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• proxy/go.mod

---

Walkthrough

The proxy module updates its indirect golang.org/x/crypto dependency from v0.51.0 to v0.52.0.

Changes

Proxy dependency update

Layer / File(s)	Summary
Update proxy crypto dependency proxy/go.mod	Updates the indirect golang.org/x/crypto dependency from v0.51.0 to v0.52.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• flightctl/flightctl-ui#713 — Previously updated the same indirect golang.org/x/crypto dependency in proxy/go.mod.

Suggested labels: proxy

Suggested reviewers: amir-yogev-gh

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Ai-Attribution	❌ Error	The commit attributes Cursor with Co-authored-by, which the check forbids for AI tools, even though Made-with: Cursor is also present.	Replace the AI Co-authored-by footer with an allowed trailer such as Made-with: Cursor or Generated-by, and keep human co-author trailers separate.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the dependency security patch in proxy and matches the stated CVE-focused update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	Only dependency version/hash lines changed in proxy/go.mod and proxy/go.sum; no secret keywords, credentialed URLs, or private keys found.
No-Weak-Crypto	✅ Passed	No weak-crypto APIs or custom crypto were added; diff is only a golang.org/x/crypto version bump plus go.sum.
No-Injection-Vectors	✅ Passed	Only dependency files changed; no source edits and search found no eval/exec/dangerouslySetInnerHTML/yaml.load usage added.
Container-Privileges	✅ Passed	Only proxy/go.mod and proxy/go.sum changed; no container/K8s manifest privilege flags or root/capability settings were introduced.
No-Sensitive-Data-In-Logs	✅ Passed	PR only bumps golang.org/x/crypto in proxy/go.mod and go.sum; no logging code or log sinks were changed.
Resource-Leaks	✅ Passed	Only proxy/go.mod and proxy/go.sum changed; no proxy Go source files were modified, so no new leak-prone file/body/socket/goroutine code was introduced.
Unchecked-Errors	✅ Passed	PASS: The PR only changes proxy/go.mod and proxy/go.sum, so it introduces no Go-source error handling changes; the ignored-error sites found are pre-existing and out of scope.
Generated-Files-Not-Hand-Edited	✅ Passed	Only proxy/go.mod and proxy/go.sum changed; none of the generated-file paths listed were edited.
I18n-Compliance	✅ Passed	Only proxy/go.mod and proxy/go.sum changed; no .tsx files or t() calls were introduced, so the i18n check is not applicable.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cve-fix/CVE-2026-46595

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands.}