fix(nexus): remediate Go dependency vulnerabilities - #4093
fix(nexus): remediate Go dependency vulnerabilities#4093plural-copilot[bot] wants to merge 1 commit into
Conversation
![plural-copilot[bot]](https://avatars.githubusercontent.com/in/916369?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:
| Name | Details |
|---|---|
| 💬 Prompt | Create a single source-remediation PR for the Nexus image used by Plural Service mgmt/console.... |
| 🔗 Run history | View run history |
Soffi AI SummaryThis PR remediates two active Go dependency vulnerabilities in the CVEs addressed:
Several indirect dependencies were also updated as required by the resolution graph ( All changes were validated with a clean ChangesNexus Go dependency vulnerability remediation
Updated: 2026-09-02 00:18 UTC |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Greptile SummaryUpdates the Nexus Go dependency graph to remediate vulnerabilities in Bifrost and x/crypto without changing the deployed image tag.
Confidence Score: 5/5The PR appears safe to merge based on the dependency changes and documented validation. The changed module versions and checksums are internally consistent, while the remaining detected advisories are either unchanged from the base revision or explicitly acknowledged as an unfixed residual issue.
|
| Filename | Overview |
|---|---|
| go/nexus/go.mod | Updates the Bifrost, x/crypto, Sonic, fasthttp, Brotli, and related Go module versions; no changed-code-triggered defect was identified. |
| go/nexus/go.sum | Synchronizes module checksums with the resolved dependency upgrades and introduces no independently actionable issue. |
Reviews (1): Last reviewed commit: "fix(nexus): remediate Go dependency vuln..." | Re-trigger Greptile
1 participant
Summary
mgmt/consoleghcr.io/pluralsh/nexus; no GitOps image tag was changed.golang.org/x/crypto v0.55.0(from v0.53.0).github.com/maximhq/bifrost/core v1.5.17(from v1.5.10).Validation
docker run --rm --user "${uid}:${gid}" -e GOWORK=off -e GOCACHE=/tmp/gocache -e GOPATH=/tmp/gopath -v "$PWD:/src" -w /src/go/nexus golang:1.26.6-alpine sh -lc '/usr/local/go/bin/go get github.com/maximhq/bifrost/core@v1.5.17 golang.org/x/crypto@v0.55.0 && /usr/local/go/bin/go mod tidy'— passed.docker run --rm --user "${uid}:${gid}" -e GOWORK=off -e GOCACHE=/tmp/gocache -e GOPATH=/tmp/gopath -v "$PWD:/src" -w /src/go/nexus golang:1.26.6-alpine sh -lc '/usr/local/go/bin/go list -m all | grep -E "^(github.com/maximhq/bifrost/core|golang.org/x/crypto) " && /usr/local/go/bin/go mod graph | grep -E "github.com/pluralsh/console/go/nexus (github.com/maximhq/bifrost/core|golang.org/x/crypto)@"'— passed; confirmed final resolved versionsv1.5.17andv0.55.0.docker run --rm --user "${uid}:${gid}" -e GOWORK=off -e GOCACHE=/tmp/gocache -e GOPATH=/tmp/gopath -v "$PWD:/src" -w /src/go/nexus golang:1.26.6 sh -lc '/usr/local/go/bin/go test -race -count=1 ./... && /usr/local/go/bin/go build -o /tmp/nexus ./cmd/main.go'— passed.docker build --pull -f go/nexus/Dockerfile -t nexus-remediation-validation:local go/nexus— passed.git diff --check— passed; onlygo/nexus/go.modandgo/nexus/go.sumchanged.Residual advisory
GO-2026-5932/golang.org/x/crypto/openpgpremains blocked and out of scope because no fixed version is available. It was intentionally not remediated.Follow-up
Publish a rebuilt Nexus image/release from this source change, then separately update the deployment image tag after that image is available.