The x/net module has only one package that imports something from x/crypto module. It's the h2i command, which imports golang.org/x/crypto/ssh/terminal:

https://github.com/golang/net/blob/fc4aabc6c91483155dade6fbb627cc953a723260/http2/h2i/h2i.go#L38

The fix for CVE-2019-11840 affected only the golang.org/x/crypto/salsa20/salsa package, so x/net doesn't use anything that would be affected.

Still, it's probably a good idea for x/net to require a newer version, in case someone does use that package indirectly.

/cc @FiloSottile @katiehockman

@dmitshur you've rephrased it perfectly. I'm requiring golang.org/x/crypto v0.0.0-20191122220453-ac88ee75c92c and end up with v0.0.0-20190308221718-c2843e01d9a2 because of the way go mod resolves dependencies.

Cheers,

Vulnerability tracking is an open ecosystem question we are working on, but I don't think it should be x/net's responsibility to pull up the version of x/crypto past a vulnerability in a component that x/net doesn't depend on.

How MVS works is that each module specifies the minimum version of its dependencies it needs to work correctly, and then the go tool will pick the highest in the graph, which is expected to work for everyone thanks to semantic versioning (and the versioned import paths).

I think requiring a security fix is akin to requiring a new API: the module that needs it must specify an explicit dependency in its go.mod. Relying on you transitive dependencies to pull it up is brittle: if tomorrow you remove your dependency on x/net, you'll be silently dropping back to an insecure version of salsa20!

In summary, if your module is using golang.org/x/crypto/salsa20, you need to specify a recent version of x/crypto in your go.mod, for example by running go get golang.org/x/crypto/salsa20.

I'm requiring golang.org/x/crypto v0.0.0-20191122220453-ac88ee75c92c and end up with v0.0.0-20190308221718-c2843e01d9a2 because of the way go mod resolves dependencies.

This is not how it's supposed to work, so if that's happening please open a cmd/go issue with reproduction instructions. You can check the actual final selected version with go list -m golang.org/x/crypto.

@FiloSottile Thanks for your time, I overlooked it.