[dependabot]

Bumps the minor-and-patch group with 1 update: github.com/emmansun/gmsm.

Updates github.com/emmansun/gmsm from 0.45.1 to 0.45.2

Release notes

Sourced from github.com/emmansun/gmsm's releases.

v0.45.2 (2026-10-29)

Security Patch

This patch updates the smx509 baseline to Go 1.26.10 and incorporates the upstream fix for CVE-2026-111943 / GO-2026-6809. Users relying on smx509.Certificate.Verify for certificate-chain validation should upgrade, especially when accepting public CA chains or using system trust stores.

Security Fix

• Reject certificate chains containing the known distrusted Subject Public Key Info (SPKI) hashes identified by the upstream fix.
• Apply the rejection in both the Go verifier and the Windows system verifier.
• Enforce the rejection even when ExtKeyUsageAny is requested.

The issue concerns continued trust in specific compromised intermediate certificates. It is not a break of SM2 or SM3, and does not by itself require rotating SM2 keys or replacing otherwise unaffected certificates.

Deployments using an explicitly restricted private PKI whose accepted chains do not contain the distrusted SPKIs are not affected by this specific issue. Using an SM2 leaf certificate alone is not sufficient to establish that a deployment is unaffected; the accepted trust chains must also be considered. Standalone SM2 message-signature verification and certificate parsing are not the affected certificate-chain verification operation.

Upgrade Guidance

• Upgrade gmsm to the release containing this fix and rebuild applications. Updating the Go toolchain alone does not update the forked verification code in older gmsm releases.
• Also use Go 1.26.10, Go 1.27.3, or a later supported security release to cover certificate verification performed by the Go standard library.
• Keep operating-system and application-managed trust stores up to date. The SPKI denylist is a targeted safeguard, not general-purpose revocation checking.

Compatibility

• No public API changes.
• The minimum Go version remains Go 1.26.0.
• Certificate chains containing a listed SPKI now fail verification. This is the intended security-related behavior change.

Maintenance

• Refresh the committed standard-library baseline and declarative source patches.
• Preserve existing SM2, post-quantum, and SM4 extensions.
• Make repeated synchronization tolerate already-applied patches and keep test files and assets out of source-only baseline synchronization.

... (truncated)

Commits

• 881a4d8 Merge pull request #659 from emmansun/develop
• 05f336b Merge pull request #658 from emmansun/main
• 53188b6 fix(smx509): sync Go 1.26.10 to address CVE-2026-111943
• f5d854c ci: fix QEMU package installation for ppc64
• 3bcf9ae build(deps): bump github/codeql-action from 4.39.0 to 4.39.1
• 13086d4 Merge pull request #653 from emmansun/develop
• 0b59afe docs: replace godoc badge with pkg.go.dev
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions