Bump golang.org/x/crypto and increase min Go version to 1.25

XMLWordPrintableJSON

    • Type: Improvement
    • Resolution: Unresolved
    • Priority: Unknown
    • None
    • Affects Version/s: None
    • Component/s: Security
    • None
    • None
    • Go Drivers
    • Hide

      1. What would you like to communicate to the user about this feature?
      2. Would you like the user to see examples of the syntax and/or executable code and its output?
      3. Which versions of the driver/connector does this apply to?

      Show
      1. What would you like to communicate to the user about this feature? 2. Would you like the user to see examples of the syntax and/or executable code and its output? 3. Which versions of the driver/connector does this apply to?
    • None
    • None
    • None
    • None
    • None
    • None

      Context

      We've had a number of request to upgrade the "golang.org/x/crypto" library recently. While the APIs we use in that module are still not impacted by any CVEs, many users seem to get CVE warnings because they're not using govulncheck.

      We should consider upgrading "golang.org/x/crypto" to a newer version and bumping the min supported Go version.

      Questions:

      • Is there a version of "golang.org/x/crypto" that resolves CVEs and also requires a version of Go that we're OK with requiring?

      Definition of done

      • Bump version of "golang.org/x/crypto" to v0.52.0
      • Bump min Go version to "1.25.0"
      • Update version list in compile_check_test.go to remove 1.19 thru 1.24
      • Update the Taskfile min Go version build check here to use 1.25 instead of 1.19
      • Update README.md and AGENTS.md to reflect that min Go version is 1.25

      Pitfalls

      The previous min version was 1.19 (released Aug 2022), so 1.25 (released Aug 2025) is a significant jump. It's possible it will require some users to upgrade Go.

            Assignee:
            Rishit Bhatia
            Reporter:
            Matt Dale
            None
            Votes:
            1 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated: