#879 [Dependency] guest_server Go deps: stale x/crypto go.sum entries, x/sys CVE-2026-39824, renovate coverage gap

What version of WinBoat are you running?

0.9.2 (packaged for NixOS); also checked current main @ b9a2df2.

Your Environment

Found while preparing #878 — ran trivy fs --scanners vuln (trivy 0.74.0) against a local WinBoat install and a clone of main.

Findings

1. Stale golang.org/x/crypto entries in guest_server/go.sum (main)

Since the guest server refactor, nothing imports golang.org/x/crypto anymore (internal/guestauth/auth.go uses stdlib crypto/subtle), and go.mod no longer requires it — but go.sum still pins golang.org/x/crypto v0.43.0 (lines 21–22). Recent trivy versions respect go.mod and don't flag it, but scanners that read go.sum directly do.

On the 0.9.x release line the guest server still imports golang.org/x/crypto/argon2 (argon2.go:10, Argon2id verification for the guest API auth) with go.mod pinning x/crypto v0.43.0, and scanners flag 19 advisories against that version:

Severity	Advisories	Fixed in
HIGH	CVE-2026-39828, -39829, -39830, -39831, -39832, -39835, -42508, -46595, -46597	0.52.0
HIGH	CVE-2026-56854	0.55.0
MEDIUM	CVE-2025-47914, CVE-2025-58181	0.45.0
MEDIUM	CVE-2026-39827, -39833, -39834, -46598	0.52.0
MEDIUM	CVE-2026-56855, CVE-2026-78662	0.56.0
—	GO-2026-5932 (`x/crypto/openpgp` unmaintained)	no fix available

For the record, none of these are reachable from WinBoat's code: the only import is argon2, and every listed advisory sits in the ssh / ssh/agent / openpgp paths. So this is dependency hygiene and audit noise rather than an exploitable path — but every trivy/grype scan of a packaged install lights up, and distro packagers (we hit this packaging 0.9.2 for NixOS) run those scanners as merge gates.

2. golang.org/x/sys v0.37.0 — CVE-2026-39824 (main + 0.9.x)

trivy flags x/sys v0.37.0 with CVE-2026-39824 — integer overflow in NewNTUnicodeString (x/sys/windows), fixed in v0.44.0, severity UNKNOWN per trivy. The guest server runs on Windows and links x/sys/windows via gopsutil, so this package is at least linked into the shipped binary.

3. Renovate doesn't cover guest_server

.github/renovate.json5 has includePaths: ["**/src/renderer/lib/**"] plus a regex manager for the dockur/windows image tag — nothing updates the Go deps in guest_server/go.mod. That's presumably why they drift: x/sys has been stuck at v0.37.0, and the earlier bump attempt #782 (x/crypto v0.53.0 / x/sys v0.46.0) was closed unmerged.

Suggested actions

go mod tidy in guest_server/ to drop the stale x/crypto entries from go.sum
bump golang.org/x/sys to ≥ v0.44.0
extend renovate.json5 to cover guest_server/** so the Go deps stop drifting
on any branch that still uses argon2: go get golang.org/x/[email protected]

Happy to send a PR for 1–3 if that's welcome.

Note: scans were run with trivy 0.74.0 and cross-checked by hand; this report was prepared with AI assistance.