Bump golang.org/x/crypto past CVE-2026-56854
Merged
JE
3mo ago+4+4+0123456789-4-4-0123456789
The Trivy Security Scan check has been red on main since af381b34 (before #665/#666): CVE-2026-56854 in the indirect golang.org/x/crypto v0.54.0, fixed upstream in v0.55.0. Both open PRs' reviewers flagged the unexplained red check; this bump owns it.
go get golang.org/x/crypto@v0.55.0 && go mod tidy, plus the nix vendorHash recompute. No direct-dependency or code changes.
Summary by cubic
Bumps the indirect golang.org/x/crypto from v0.54.0 to v0.55.0 to resolve CVE-2026-56854, which has been failing the Trivy security scan on main.
No behavior changes; the dependency is indirect and the nix vendor hash is recomputed to match.