fix(nexus): remediate Bifrost and x/crypto vulnerabilities

[plural-copilot]

Summary

Remediates the version-fixable Go dependency findings for the Nexus AI proxy backing the live Console workload.

• Plural Service: mgmt/console
• Scan context: deployed image ghcr.io/pluralsh/nexus:0.12.40, workload console-nexus

Findings remediated

Finding package	Prior resolved version	Resolved version	Resolution
golang.org/x/crypto	v0.53.0	v0.55.0	Resolves CVE-2026-56854 — SSH source-address restriction bypass (CVSS 9.1).
github.com/maximhq/bifrost/core	v1.5.10	v1.5.17	Resolves the Bifrost SSRF deny-list incompleteness finding.

github.com/maximhq/bifrost/core is a direct Nexus dependency. golang.org/x/crypto remains indirect, but is explicitly resolved at the secure v0.55.0 minimum. Go minimal-version selection updated compatible supporting dependencies required by Bifrost v1.5.17 (including Sonic, Brotli, FastHTTP, x/net, x/sys, and x/text).

Changed files

• go/nexus/go.mod — updates the Nexus module requirements and resolved indirect dependency versions.
• go/nexus/go.sum — refreshes checksums for the resolved module graph.

No application source, Dockerfile, workflow, GitOps manifest, deployment image tag, Redis, cloud-query-db/cloud-db, or plural-cli files were changed.

Validation

Executed using the Nexus Docker toolchain (golang:1.26.6-alpine) because Go is not installed in the agent environment:

timeout 15m docker run --rm -v "$PWD/go/nexus:/src" -w /src golang:1.26.6-alpine sh -ec '
  go mod download
  go mod verify
  cp go.mod /tmp/go.mod.before
  cp go.sum /tmp/go.sum.before
  go mod tidy
  diff -u /tmp/go.mod.before go.mod
  diff -u /tmp/go.sum.before go.sum
  go test ./...
  go build -o /tmp/nexus ./cmd/main.go
  go list -m -f "{{.Path}} {{.Version}}" github.com/maximhq/bifrost/core golang.org/x/crypto
'

Result: passed — all modules verified; go mod tidy left go.mod/go.sum unchanged; all Nexus tests passed; the Nexus binary built; resolved versions printed as github.com/maximhq/bifrost/core v1.5.17 and golang.org/x/crypto v0.55.0.

timeout 15m docker build -t nexus-remediation-validation:local -f go/nexus/Dockerfile go/nexus

Result: passed — successfully built and tagged nexus-remediation-validation:local.

git diff --check

Result: passed.

Exclusions and limitations

• golang.org/x/crypto/openpgp remains unremediated: its advisory has no version-only fixed release. This PR deliberately does not attempt a speculative migration or removal.
• This PR intentionally does not update GitOps manifests or any image tag. A rebuilt immutable ghcr.io/pluralsh/nexus image must be published from this change before an eventual GitOps deployment tag bump; that deployment bump is outside this PR.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create exactly one remediation PR in this repository for the live mgmt/console Nexus/AI-proxy image finding. The affected deployed image is ghcr.io/pluralsh/nexus:0.12.40, workload console-nexus....
🔗 Run history	View run history

[soffi-ai]

Soffi AI Summary

This PR remediates two security vulnerabilities in the Nexus AI proxy module (go/nexus) by bumping affected Go dependencies to patched versions.

CVE-2026-56854 (golang.org/x/crypto): An SSH source-address restriction bypass with CVSS 9.1 severity. The indirect dependency is explicitly pinned to v0.55.0 (up from v0.53.0) to enforce the fix via Go's minimal-version selection.

Bifrost SSRF deny-list incompleteness (github.com/maximhq/bifrost/core): A server-side request forgery vulnerability in the direct Bifrost dependency, resolved by upgrading from v1.5.10 to v1.5.17.

Supporting dependencies pulled in transitively by the Bifrost upgrade — including Sonic, Brotli, FastHTTP, x/net, x/sys, and x/text — are also updated to their compatible newer versions. No application source code, Dockerfiles, GitOps manifests, or image tags were changed. The fix was validated by verifying module checksums, running go mod tidy (no-op), executing all Nexus tests, and building the Nexus binary inside the official Go Docker toolchain.

Changes

Security vulnerability remediation for Nexus AI proxy

• Upgrades github.com/maximhq/bifrost/core from v1.5.10 to v1.5.17 (fixes a Bifrost SSRF deny-list incompleteness finding) and explicitly pins golang.org/x/crypto to v0.55.0 (fixes CVE-2026-56854, an SSH source-address restriction bypass with CVSS 9.1). Also updates compatible transitive dependencies (Sonic, Brotli, FastHTTP, x/net, x/sys, x/text) required by the Bifrost upgrade, touching only go/nexus/go.mod and go/nexus/go.sum. (a3fd8e1)

---

Updated: 2026-09-01 20:39 UTC

Deploy in Soffi

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​bytedance/​sonic@​v1.15.1
	golang/​github.com/​maximhq/​bifrost/​core@​v1.5.10 ⏵ v1.5.17	+1	+16

View full report

[greptile-apps]

Greptile Summary

This PR upgrades Bifrost and x/crypto to remediate version-fixable Nexus vulnerabilities and refreshes the supporting Go module graph.

• Upgrades github.com/maximhq/bifrost/core from v1.5.10 to v1.5.17.
• Upgrades golang.org/x/crypto from v0.53.0 to v0.55.0.
• Updates compatible transitive dependencies and module checksums.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified in the dependency updates.

The targeted versions and supporting module graph are updated consistently, while the remaining advisory leads either predate this change or lack a reachable affected API path.

Important Files Changed

Filename	Overview
go/nexus/go.mod	Updates the targeted security-sensitive dependencies and compatible supporting modules without an identified changed-code regression.
go/nexus/go.sum	Refreshes checksums consistently with the updated module graph.

_{Reviews (1): Last reviewed commit: "fix(nexus): remediate Bifrost and xcrypt..." | Re-trigger Greptile}