Bump cloudflare/circl from v1.6.1 to v1.6.3#4671
Merged
simonfaltum merged 3 commits intomainfrom Mar 6, 2026
Merged
Conversation
Fixes CVE-2026-1229: incorrect calculation in CIRCL secp384r1 CombinedMult. The CLI pulls in circl as an indirect dependency via go-crypto, hc-install, and terraform-exec. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Collaborator
|
Commit: 8b87e7b
25 interesting tests: 8 FAIL, 7 KNOWN, 7 SKIP, 1 BUG, 1 flaky, 1 RECOVERED
Top 20 slowest tests (at least 2 minutes):
|
pietern
approved these changes
Mar 6, 2026
Collaborator
|
Commit: 1d44462
47 interesting tests: 16 FAIL, 16 RECOVERED, 7 KNOWN, 6 flaky, 1 BUG, 1 SKIP
Top 50 slowest tests (at least 2 minutes):
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A customer reported that their Artifactory vulnerability scanner is blocking the CLI due to CVE-2026-1229 in
cloudflare/circl< v1.6.3. The vulnerability is an incorrect calculation in the CIRCL secp384r1 CombinedMult function (CVSS 2.9/LOW). ECDH and ECDSA signing are not affected.Changes
Bumps the indirect dependency
cloudflare/circlfrom v1.6.1 to v1.6.3 in go.mod/go.sum. The dependency is pulled in transitively viago-crypto,hc-install, andterraform-exec.Test plan
make checkspasses