SECURESIGN-5484 Upversion golang.org/x/crypto v0.55.0

[jkopriva]

No description provided.

[qodo-for-securesign]

PR Summary by Qodo

Upversion golang.org/x/crypto to v0.55.0

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Upgrades golang.org/x/crypto to v0.55.0 across root and fake OIDC modules.
• Synchronizes related direct, indirect, and checksum dependency metadata.

High-Level Assessment

The coordinated module-manifest and checksum update is the appropriate approach because both the root module and fake OIDC test module resolve golang.org/x/crypto independently. Updating only one module would leave inconsistent crypto versions, while manual pinning would add unnecessary dependency-management complexity.

Files changed (4) +17 / -17

Other (4) +17 / -17

go.modUpgrade crypto and resolved root-module dependencies +6/-6

Upgrade crypto and resolved root-module dependencies

• Upgrades golang.org/x/crypto to v0.55.0 and GitLab API client-go to v1.46.0. Adjusts resolved versions of golang.org/x/mod, x/text, x/tools, and google.golang.org/genproto.

go.mod

go.sumRefresh root-module dependency checksums +8/-8

Refresh root-module dependency checksums

• Replaces checksums for the previous crypto, mod, text, and tools versions with checksums for their newly resolved releases.

go.sum

go.modAlign fake OIDC crypto dependency +1/-1

Align fake OIDC crypto dependency

• Upgrades the fake OIDC module's indirect golang.org/x/crypto dependency from v0.50.0 to v0.55.0.

test/fakeoidc/go.mod

go.sumRefresh fake OIDC crypto checksums +2/-2

Refresh fake OIDC crypto checksums

• Replaces the v0.50.0 crypto checksums with the v0.55.0 module and manifest checksums.

test/fakeoidc/go.sum

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. GitLab checksums remain stale ✓ Resolved 🐞 Bug ☼ Reliability

Description

The root module now requires GitLab client v1.46.0, but go.sum contains only v1.23.0 checksums
even though the client is imported by production code. Clean builds must resolve and write the
missing checksums at build time, breaking readonly or offline dependency workflows and leaving the
committed dependency manifest incomplete.

Code

go.mod[54]

+	gitlab.com/gitlab-org/api/client-go v1.46.0

Evidence

go.mod selects v1.46.0 and production GitLab integration code imports the module, but the
corresponding go.sum region still contains only v1.23.0 entries. Therefore the checked-in checksum
manifest does not cover the version introduced by this PR.

go.mod[54-55]
go.sum[759-760]
pkg/cosign/git/gitlab/gitlab.go[24-28]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The direct GitLab client dependency was upgraded to v1.46.0 without updating its entries in the root `go.sum`. Regenerate the module metadata so clean and readonly builds have committed checksums for the selected version.

## Issue Context
Production code imports this module, while `go.sum` still records only v1.23.0.

## Fix Focus Areas
- go.mod[54-54]
- go.sum[759-760]
- pkg/cosign/git/gitlab/gitlab.go[24-28]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can ask Qodo to dismiss a finding you disagree with, with your reason on record

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[jkopriva]

/retest

[jkopriva]

/retest

[red-hat-konflux]

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.