[bryan-minimal]

croc 11.1.0 → 11.5.4. Clears GHSA-x89h (fixed in 11.5.2); 11.5.4 is the latest release (2026-09-26). Replaces #750 (11.5.3). Main has been on Go 1.27.0 since #667, which satisfies croc's go 1.27.0 (no toolchain line), so this no longer waits on #758.

Only version + source sha256 change. The source is the same gs://minimal-staging-archives mirror convention as 11.1.0: the object is GitHub's release archive, byte-for-byte. v11.5.4.tar.gz sha256 16910b594704b40e9df35eb3bc637db675fe3d770a4588bd32b5a12c5ff174ff matches two independent downloads of codeload.github.com/schollz/croc/tar.gz/refs/tags/v11.5.4. Mirrored by hand, see below.

⚠️ Why this is hand-cut and a DRAFT: pkgmgr's scan-before-mirror gate flagged 13 Critical findings

The updater refused to mirror or PR this (anti-xz gate, pkgscan-critical). All 13 findings are the persistence/filesystem rule matching the strings .bashrc / .zshrc. Audit: I diffed every occurrence of .bashrc|.zshrc|.profile|.bash_profile|/etc/profile|crontab|authorized_keys|.ssh/ between the v11.1.0 and v11.5.4 source trees, not just the reported 13. The only NEW occurrences are:

• Test files only (src/croc/{overwrite,stdout_cleanup,sending_text,croc}_test.go, src/receivefs/path_test.go, src/utils/utils_test.go, web/src/protocol/metadata.test.ts). These are croc's own security regression tests for this very fix. They attempt to deliver .bashrc / .ssh/authorized_keys (for example ".ssh/authorized_keys": "attacker-key") and assert the file is not overwritten or created. All of them run in t.TempDir() after t.Chdir.
• scripts/install-benchmark-prereqs.sh: the maintainers' Ubuntu/Debian benchmark-machine setup (it installs Go and NVM; NVM's installer appends to ~/.bashrc / ~/.zshrc via PROFILE). It's referenced by neither croc's Makefile nor its CI. Our build.sh only runs go build, so it never runs here.

None are in shipped (non-test) source. "It's a test file" was not taken on trust (xz hid its payload in test fixtures): each flagged test was read.

Reviewer: please confirm the audit before un-drafting. The build still needs the usual buildbot pass.

(Tooling gaps found here, being fixed in pkgmgr-rs: the gs:// gate has no operator override even after a human audit + mirror, pkgscan diff can't audit a not-yet-mirrored version, and the Slack alert suggests --allow-critical-pkgscan, which can't work for gs:// packages.)

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 41 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 57 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: c1c53e30-93ba-4ce3-9bfc-eefa79806374

📥 Commits

Reviewing files that changed from the base of the PR and between 61d7c2f and 20d5cd5.

📒 Files selected for processing (1)

• packages/croc/build.ncl

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[bryan-minimal]

Build evidence: the superseded #750 (croc 11.5.3, same go 1.27.0 requirement as 11.5.4) went green on minimal build against main's Go 1.27.0 after I merged main into it (all 11 checks passed), just before it was closed in favour of this PR. So the Go-1.27 blocker is gone; this PR's own buildbot run is the confirmation for 11.5.4.