calico-3.31/3.31.2-r4: cve remediation

[octo-sts]

calico-3.31/3.31.2-r4: fix GHSA-r6j8-c6r2-37rr

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/calico-3.31.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

Inspected git repositories: https://github.com/projectcalico/calico@v3.31.2

[octo-sts]

🔢 Build Failed: Dependency Version Mismatch

package golang.org/x/crypto: requested version 'v0.45.0', is already at version 'v0.46.0'

Build Details

Category	Details
Build System	melange/go
Failure Point	gobump command during go/bump step

Root Cause Analysis 🔍

The build configuration is attempting to downgrade golang.org/x/crypto from v0.46.0 to v0.45.0, which is not allowed. The package is already at a newer version (v0.46.0) than the requested version (v0.45.0), causing a version constraint conflict.

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.