When can we expect to have minor release which includes newer crypto package

[CodingBurak]

When can we expect to have minor release which includes newer crypto package 54f2089 ? As this has a critical CVE reported here: https://www.cve.org/CVERecord?id=CVE-2024-45337

[sagikazarmark]

A release is really due now, but I can't say for sure. But you should be able to use an updated version of the crypto package in your projects.

[CodingBurak]

A release is really due now, but I can't say for sure. But you should be able to use an updated version of the crypto package in your projects.

So we dont have a direct dependency to crypto itself, but have a dependency to viper. I think I cant force viper to use the updated crypto package.

[sagikazarmark]

Yes you can: just make sure to have an updated version in your go.mod file.