Skip to content

Conversation

@red-hat-konflux
Copy link
Contributor

@red-hat-konflux red-hat-konflux bot commented Nov 24, 2025

This PR contains the following updates:

Package Change Age Confidence
github.com/xdg-go/scram v1.1.2 -> v1.2.0 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.


Release Notes

xdg-go/scram (github.com/xdg-go/scram)

v1.2.0

Compare Source

Added
  • Channel binding support for SCRAM-PLUS variants (RFC 5929, RFC 9266)
  • GetStoredCredentialsWithError() method that returns errors from PBKDF2
    key derivation instead of panicking.
  • Support for Go 1.24+ stdlib crypto/pbkdf2 package, which provides
    FIPS 140-3 compliance when using SHA-256 or SHA-512 hash functions.
Changed
  • Minimum Go version bumped from 1.11 to 1.18.
  • Migrated from github.com/xdg-go/pbkdf2 to stdlib crypto/pbkdf2 on
    Go 1.24+. Legacy Go versions (<1.24) continue using the external
    library via build tags for backward compatibility.
  • Internal error handling improved for PBKDF2 key derivation failures.
Deprecated
  • GetStoredCredentials() is deprecated in favor of
    GetStoredCredentialsWithError(). The old method panics on PBKDF2
    errors to maintain backward compatibility but will be removed in a
    future major version.
Notes
  • FIPS 140-3 compliance is available on Go 1.24+ when using SCRAM-SHA-256
    or SCRAM-SHA-512 with appropriate salt lengths (≥16 bytes). SCRAM-SHA-1
    is not FIPS-approved.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.


Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux red-hat-konflux bot force-pushed the konflux/mintmaker/main/github.com-xdg-go-scram-1.x branch from 997a3eb to df068cc Compare November 24, 2025 16:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants