Context
govulncheck reports GO-2026-5932: golang.org/x/crypto/openpgp is unmaintained, unsafe by design, and will never get a fixed version (Fixed in: N/A). ccat reaches it through github.com/creativeprojects/go-selfupdate (its PGP validator, validate.go).
Risk assessment (2026-08-22)
Low practical exposure: ccat's updater uses only the ChecksumValidator (pkg/selfupdate/selfupdate.go:43) — the openpgp signature-verification paths are linked into the binary but never invoked (govulncheck's traces are init-chain reachability plus one errors.StructuralError.Error string call). Nothing to hotfix.
Status upstream
As of today, go-selfupdate v1.6.0 (latest tag) and master still import golang.org/x/crypto/openpgp, so there is no version to bump to.
Options, when someone wants this gone
- Wait for / nudge upstream to migrate to the maintained
github.com/ProtonMail/go-crypto/openpgp fork (API-compatible drop-in for this usage) — possibly contribute the PR, it's a small diff in validate.go
- If upstream stalls: vendor a small checksum-only updater, or accept the advisory as a permanent known-issue (no scanner will ever turn it green — 'Fixed in: N/A')
Note: this advisory does NOT appear in Dependabot/Trivy alerts — only govulncheck surfaces it. Re-run with:
go run golang.org/x/vuln/cmd/govulncheck@latest -tags libcurl,crappy,keystore ./...
🤖 Issue drafted with Claude Code
Context
govulncheckreports GO-2026-5932:golang.org/x/crypto/openpgpis unmaintained, unsafe by design, and will never get a fixed version (Fixed in: N/A). ccat reaches it throughgithub.com/creativeprojects/go-selfupdate(its PGP validator,validate.go).Risk assessment (2026-08-22)
Low practical exposure: ccat's updater uses only the
ChecksumValidator(pkg/selfupdate/selfupdate.go:43) — the openpgp signature-verification paths are linked into the binary but never invoked (govulncheck's traces areinit-chain reachability plus oneerrors.StructuralError.Errorstring call). Nothing to hotfix.Status upstream
As of today, go-selfupdate v1.6.0 (latest tag) and master still import
golang.org/x/crypto/openpgp, so there is no version to bump to.Options, when someone wants this gone
github.com/ProtonMail/go-crypto/openpgpfork (API-compatible drop-in for this usage) — possibly contribute the PR, it's a small diff invalidate.goNote: this advisory does NOT appear in Dependabot/Trivy alerts — only govulncheck surfaces it. Re-run with:
🤖 Issue drafted with Claude Code