Upgrade Go dependencies (x/crypto, paho.mqtt.golang)

[anhuv]

Branch/Environment/Version

• Branch/Version: master
• Environment: N/A (dependency update)

---

Describe the bug

Tyk Gateway is using outdated Go dependencies that should be upgraded for maintenance and security reasons.

---

Reproduction steps

1. Check go.mod

2. Note the following versions:

   • golang.org/x/crypto v0.41.0
   • github.com/eclipse/paho.mqtt.golang v1.4.3

---

Actual behavior

Older dependency versions are currently in use.

---

Expected behavior

Upgrade to newer maintained versions:

• golang.org/x/crypto v0.46.0
• github.com/eclipse/paho.mqtt.golang v1.5.1

---

Screenshots/Video

N/A

---

Logs (debug mode or log file):

N/A

---

Configuration (tyk config file):

N/A

---

Additional context

N/A

[probelabs]

Thank you for your contribution!

Hello @anhuv, thank you for opening this issue and suggesting these dependency upgrades. Keeping our dependencies current is important for both security and maintenance.

Triage & Analysis

Based on your report, I've reviewed the usage of these libraries within the Tyk Gateway repository.

• golang.org/x/crypto: This is a widely used package, and keeping it up-to-date is standard practice.
• github.com/eclipse/paho.mqtt.golang: My analysis indicates that this library is used exclusively for our internal testing and load-generation scripts, not in the core gateway runtime. This significantly reduces the risk associated with an upgrade.

This appears to be a straightforward maintenance task with low complexity.

Next Steps

To help us prioritize this work, could you let us know if you are aware of any specific security vulnerabilities (e.g., CVEs) associated with the current versions? While we agree that updating dependencies is a good practice, having a specific security context can help raise the priority.

In the meantime, we will add this to our backlog for consideration.

References

• go.mod – Lists project dependencies.
• gateway/mw_streaming_mqtt_test.go – Test file using the paho.mqtt.golang client.
• tests/streams/scripts/mqtt_load_generator.go – Load generator script using the paho.mqtt.golang client.

---

Powered by Visor from Probelabs

💡 TIP: You can chat with Visor using /visor ask <your question>