When Will CVE-2025-47913 Fix in Main Branch Be Released?

[yijsap]

We use the NGINX Kubernetes Ingress Controller (nginx/kubernetes-ingress) v5.2.1. Our security scanner flagged CVE-2025-47913, which is a vulnerability in the Go package golang.org/x/crypto/ssh/agent (versions < 0.43.0). Your main branch already uses v0.45.0, which I assume can address this CVE.

Questions:

1. Is there a planned release that includes this dependency update so that it will be included in a formal release version?
2. If a release timeline is not fixed, would building from main be the recommended approach for immediate mitigation?

Thank you for your guidance!

[haywoodsh]

Hi @yijsap
The code in the main branch will be included in the next release.
This project is released quarterly, so you can expect a new version in the coming weeks.