go.mod pins golang.org/x/crypto v0.38.0 (2025-05). keyfunc ssh to serves keys with that module's ssh/agent package, which has had security fixes since (agent request handling that a peer could crash). filippo.io/age, golang.org/x/term, golang.org/x/sys, cobra and testify are also behind. A 1.0 should not ship on dependencies with published fixes outstanding.
Implementation
Update every direct dependency to its current release and run go mod tidy. go get and go mod tidy have no make target and may be run directly; everything else goes through make.
Do not change .golangci.yml. Fix whatever the update makes the compiler or linter complain about, by hand.
The derivation must not move: the SSH, age and child mnemonic test vectors in the tree pass unchanged. A test vector that has to change is a stop, reported on the PR.
Definition of done
go.mod/go.sum updated and tidy; no direct dependency has a newer release on the day of the PR (the PR body names any held back and why, one line each).
make check green with no test vector edited. Branch cut from next, PR base next.
Model: fable-5-1
`go.mod` pins `golang.org/x/crypto v0.38.0` (2025-05). `keyfunc ssh to` serves keys with that module's `ssh/agent` package, which has had security fixes since (agent request handling that a peer could crash). `filippo.io/age`, `golang.org/x/term`, `golang.org/x/sys`, `cobra` and `testify` are also behind. A 1.0 should not ship on dependencies with published fixes outstanding.
## Implementation
- Update every direct dependency to its current release and run `go mod tidy`. `go get` and `go mod tidy` have no make target and may be run directly; everything else goes through `make`.
- Do not change `.golangci.yml`. Fix whatever the update makes the compiler or linter complain about, by hand.
- The derivation must not move: the SSH, age and child mnemonic test vectors in the tree pass unchanged. A test vector that has to change is a stop, reported on the PR.
## Definition of done
- `go.mod`/`go.sum` updated and tidy; no direct dependency has a newer release on the day of the PR (the PR body names any held back and why, one line each).
- `make check` green with no test vector edited. Branch cut from `next`, PR base `next`.
Model: fable-5-1
clawbot
self-assigned this 2026-09-21 09:18:05 +02:00
Updated every direct dependency to its current release (age, cobra, testify, x/crypto, x/term, btcutil) and ran go mod tidy; go-bip39 and the secret module were already current. make check is green with no test vector changed.
One dependency held back: btcd stays at v0.25.0. v0.26.x moved the chaincfg and wire packages into separate /v2 modules; keyfunc imports v1 chaincfg and the pinned secret dependency pulls v1 btcutil (which needs v1 wire), so v0.26.x is a breaking migration needing upstream work, out of scope here. v0.25.0 is the newest release still shipping the v1 packages.
Model: opus-4-8
PR: https://git.eeqj.de/sneak/keyfunc/pulls/25
Updated every direct dependency to its current release (age, cobra, testify, x/crypto, x/term, btcutil) and ran go mod tidy; go-bip39 and the secret module were already current. make check is green with no test vector changed.
One dependency held back: btcd stays at v0.25.0. v0.26.x moved the chaincfg and wire packages into separate /v2 modules; keyfunc imports v1 chaincfg and the pinned secret dependency pulls v1 btcutil (which needs v1 wire), so v0.26.x is a breaking migration needing upstream work, out of scope here. v0.25.0 is the newest release still shipping the v1 packages.
Model: opus-4-8
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
go.modpinsgolang.org/x/crypto v0.38.0(2025-05).keyfunc ssh toserves keys with that module'sssh/agentpackage, which has had security fixes since (agent request handling that a peer could crash).filippo.io/age,golang.org/x/term,golang.org/x/sys,cobraandtestifyare also behind. A 1.0 should not ship on dependencies with published fixes outstanding.Implementation
go mod tidy.go getandgo mod tidyhave no make target and may be run directly; everything else goes throughmake..golangci.yml. Fix whatever the update makes the compiler or linter complain about, by hand.Definition of done
go.mod/go.sumupdated and tidy; no direct dependency has a newer release on the day of the PR (the PR body names any held back and why, one line each).make checkgreen with no test vector edited. Branch cut fromnext, PR basenext.Model: fable-5-1
PR: #25
Updated every direct dependency to its current release (age, cobra, testify, x/crypto, x/term, btcutil) and ran go mod tidy; go-bip39 and the secret module were already current. make check is green with no test vector changed.
One dependency held back: btcd stays at v0.25.0. v0.26.x moved the chaincfg and wire packages into separate /v2 modules; keyfunc imports v1 chaincfg and the pinned secret dependency pulls v1 btcutil (which needs v1 wire), so v0.26.x is a breaking migration needing upstream work, out of scope here. v0.25.0 is the newest release still shipping the v1 packages.
Model: opus-4-8