[haukened]

Name of feature:

Just a dependency bump for a security fix. No behavior change.

Pain or issue this feature alleviates:

step pulls in pgx indirectly (via smallstep/certificates → smallstep/nosql) and it's sitting at v5.9.2, which is affected by two advisories:

• GHSA-j38q-h3ph-jjpq - SQL injection in simple-protocol batches
• GHSA-95fj-3fxw-g62g - require_auth / channel_binding bypass (5.9.0 through 5.11.0)

This bumps it to v5.12.0. The only other thing that moves is puddle/v2 (2.2.2 → 2.2.3). I skipped 5.13.0 on purpose since it changes how client certs get loaded - seemed better reviewed on its own. I'm guessing Dependabot missed this one because it's an indirect dependency.

Why is this important to the project (if not answered above):

Bit of context: I've been chasing down the scanner findings in smallstep/step-ca:0.30.2. step-cli:latest is the base for the step-ca and step-kms-plugin images, and it's also where their step binary comes from. Xray pins 104 of the 231 findings in step-ca on that step binary.

Good news is master is already in great shape. With this bump, Trivy goes from 32 findings in the step binary of the published step-cli:0.31.0 down to 1, and that last one is just the x/crypto/openpgp deprecation notice (GO-2026-5932). step doesn't import openpgp, and govulncheck says it's never called. The only fix is x/crypto v0.59.0, which drops DSA from x/crypto/ssh - step ssh fingerprint on an ssh-dss key would stop working - so I left that for you and Dependabot.

The big ask: if a CLI release could go out before the end-of-November step-ca release, that's what actually gets all of this into the step-ca image. Otherwise step-ca keeps shipping the September step binary.

Is there documentation on how to use this feature? If so, where?

N/A - nothing user-facing.

In what environments or workflows is this feature supported?

• Ran your CI locally on Go 1.26 and 1.27: golangci-lint v2.13.2 with your shared config, the generate and tidy checks, govulncheck, the full test suite (392 tests), make build, and CodeQL. All green, and CodeQL comes back identical to master.
• Built both docker/Dockerfile and docker/Dockerfile.debian, then used them as the base for the step-ca and step-kms-plugin images in the companion PRs. Those all pass end-to-end checks: CA init, health, issuing certs, step kms, and a real Postgres backend.

In what environments or workflows is this feature explicitly NOT supported (if any)?

None.

Supporting links/other PRs/issues:

• Companion PRs: Upgrade OS packages in images and bump pgx to v5.12.0 certificates#2854 (pgx bump + OS package upgrade in the images), Upgrade OS packages in Docker images step-kms-plugin#390 (OS package upgrade in the images)