fix: upgrade golang.org/x/crypto to v0.56.0
Closed
CH
2mo ago+3+3+0123456789-1-1-0123456789
Summary
Bump golang.org/x/crypto from v0.55.0 to v0.56.0 so the repository no longer pins the vulnerable module version flagged by GO-2026-6354-golang.org/x/crypto. This is the minimal manifest-only remediation for the scanner finding.
Vulnerability Fixed
GO-2026-6354-golang.org/x/crypto (HIGH): golang.org/x/crypto/ssh could deadlock an SSH connection when a malicious peer floods requests before a channel is established.
Changes Made
- Updated
golang.org/x/cryptoingo.modfromv0.55.0tov0.56.0, the first fixed release identified by the assessment hint and verified withgo list -m -json golang.org/x/crypto@v0.56.0. - Added the corresponding
v0.56.0checksums togo.sumso the patched module version is recorded for reproducible resolution.
Verification
Ran syft dir:. -o cyclonedx-json=/workspace/run/out/sbom.json && grype sbom:/workspace/run/out/sbom.json --only-fixed -o json against /workspace/run/repo. Outcome: resolved — grype did not report GO-2026-6354-golang.org/x/crypto in the patched SBOM.