security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-45gg-vh54-h5m9	golang.org/x/crypto	None	v0.47.0	0.52.0		confirmed

Not Included

• Deferred by batch limit: 128 advisories. They will be considered by future runs.
• Other deferred scanner findings: 9.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	json-schema	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	float	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	hashes	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	cheerio	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	typebox	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	runtime	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/godbus/dbus/v5	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	golang.org/x/crypto	Missing CVE/GHSA identifier required for Socket fix planning.
Unavailable from detector	authlib	Missing CVE/GHSA identifier required for Socket fix planning.

---

Note

Low Risk
Scope is lockfile/module version bumps with no CLI code changes; typical low-risk dependency patch, though crypto library updates warrant normal regression smoke tests.

Overview
Dependency-only security remediation for GHSA-45gg-vh54-h5m9 by upgrading golang.org/x/crypto from v0.47.0 to v0.52.0 in go.mod, with matching go.sum checksum updates.

The same bump pulls in aligned golang.org/x transitives: sync v0.19.0 → v0.20.0, term v0.39.0 → v0.43.0, and indirect sys / text revisions. No application source files change in this diff.

^{Reviewed by Cursor Bugbot for commit 58b7803. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​golang.org/​x/​crypto@​v0.47.0 ⏵ v0.52.0	+1	+75
	golang/​golang.org/​x/​sync@​v0.19.0 ⏵ v0.20.0
	golang/​golang.org/​x/​term@​v0.39.0 ⏵ v0.43.0

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[firetiger-agent]

Created a monitoring plan for this PR.

What this PR does: Patches a high-severity security vulnerability (GHSA-537c-gmf6-5ccf — vulnerable OpenSSL in cryptography wheels) in the CLI's browser-use sample app template. New projects scaffolded from this template will no longer include the affected dependency.

Intended effect: No production telemetry signal exists for CLI template usage — this is a template-only change with no deployed service. Confirmation is structural: the lockfile pins browser-use==0.12.3 and aiohttp==3.13.3, which resolve without the vulnerable OpenSSL transitive dependency. Manual validation (run uv sync + scaffold and execute the template) is the only applicable check.

Risks:

• browser-use API break — browser-use 0.11→0.12 may change Browser/Agent constructor signatures; alert if scaffolded template fails to run (ImportError or TypeError at startup)
• aiohttp 3.13.x incompatibility — transitive bump from 3.12.15 to 3.13.3; alert if uv sync fails or generated app raises aiohttp-related exceptions at startup
• lockfile resolution failure on edge Python versions — pinned wheels may be missing for some platforms; alert if uv sync errors on supported Python ≥3.11 runtimes

View monitor

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit dc2084d. Configure here.}

[cursor]

Claimed vulnerability fix missing

High Severity

This PR marks GHSA-537c-gmf6-5ccf as confirmed fixed via a browser-use bump, but the diff only updates Go modules such as golang.org/x/crypto. The advisory targets PyPI cryptography (patched in 48.0.1), and the shipped browser-use template still pins browser-use 0.11.1 with cryptography 46.0.3, so the vulnerability remains.

 

^{Reviewed by Cursor Bugbot for commit dc2084d. Configure here.}