deps: bump golang.org/x/crypto to v0.56.0 and build with Go 1.26 (#5558)

mirror of https://github.com/fatedier/frp.git synced 2026-10-15 02:35:56 +08:00

x/crypto v0.56.0 fixes two denial-of-service bugs in golang.org/x/crypto/ssh
channel handling (GO-2026-6354 / CVE-2026-78662, GO-2026-6355 /
CVE-2026-56855), reachable through the frps SSH tunnel gateway in pkg/ssh.
v0.55.0 fixes GO-2026-6303 / CVE-2026-56854. v0.56.0 requires Go 1.26, so the
go directive, CI and Docker builders move from 1.25 to 1.26; Go 1.25 stopped
receiving security fixes when Go 1.27 was released.

Also bumps github.com/Azure/go-ntlmssp to v0.1.1 (GO-2026-5543 /
CVE-2026-32952).


Claude-Session: https://claude.ai/code/session_01FV4GkYDtbatepp2KH3s247

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

This commit is contained in:

stefanzier-prophet

2026-10-08 22:06:35 +08:00

committed by

GitHub

co-authored by

Claude Opus 5.5

parent d5636108e6

commit f8be1cdfe2

7 changed files with 21 additions and 21 deletions

									
										.circleci/config.yml
									
		+1
		-1
	
												View File
												
				@@ -2,7 +2,7 @@ version: 2.1

				jobs:

				  go-version-latest:

				    docker:

				    - image: cimg/go:1.25-node

				    - image: cimg/go:1.26-node

				    resource_class: large

				    steps:

				    - checkout