chore(deps): update module golang.org/x/crypto to v0.56.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/crypto	v0.53.0 → v0.56.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

CVE-2026-56854 / GO-2026-6303

More information

Details

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

Severity

Unknown

References

• https://go.dev/issue/80213
• https://go.dev/cl/797040

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

CVE-2026-78662 / GO-2026-6354

More information

Details

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.

Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Severity

Unknown

References

• https://go.dev/issue/81316
• https://go.dev/cl/826504
• https://groups.google.com/g/golang-announce/c/1y3fb2np35U

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

CVE-2026-56855 / GO-2026-6355

More information

Details

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.

Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Severity

Unknown

References

• https://go.dev/issue/81317
• https://go.dev/cl/826524
• https://groups.google.com/g/golang-announce/c/1y3fb2np35U

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.8 -> 1.26.0
golang.org/x/net	v0.56.0 -> v0.57.0
golang.org/x/sync	v0.21.0 -> v0.22.0
golang.org/x/sys	v0.46.0 -> v0.47.0
golang.org/x/text	v0.39.0 -> v0.41.0

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

go: downloading go1.26.0 (linux/amd64)
go: downloading github.com/google/go-cmp v0.7.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.44.0
go: downloading go.opentelemetry.io/otel/sdk v1.44.0
go: downloading gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
go: downloading github.com/Azure/azure-sdk-for-go v65.0.0+incompatible
go: downloading github.com/Azure/go-autorest/autorest v0.11.28
go: downloading github.com/Azure/go-autorest v14.2.0+incompatible
go: downloading github.com/Azure/go-autorest/autorest/adal v0.9.21
go: downloading github.com/hashicorp/consul/api v1.18.0
go: downloading github.com/digitalocean/godo v1.91.1
go: downloading github.com/miekg/dns v1.1.50
go: downloading github.com/fsnotify/fsnotify v1.6.0
go: downloading github.com/hetznercloud/hcloud-go v1.38.0
go: downloading github.com/ionos-cloud/sdk-go/v6 v6.1.3
go: downloading k8s.io/api v0.26.8
go: downloading k8s.io/apimachinery v0.26.8
go: downloading k8s.io/client-go v0.26.8
go: downloading github.com/linode/linodego v1.9.3
go: downloading github.com/docker/docker v20.10.21+incompatible
go: downloading github.com/hashicorp/nomad/api v0.0.0-20221214074818-7dbbf6bc584d
go: downloading github.com/gophercloud/gophercloud v1.1.1
go: downloading github.com/ovh/go-ovh v1.3.0
go: downloading github.com/scaleway/scaleway-sdk-go v1.0.0-beta.10
go: downloading github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b
go: downloading github.com/vultr/govultr/v2 v2.17.2
go: downloading github.com/envoyproxy/go-control-plane/envoy v1.37.0
go: downloading github.com/envoyproxy/go-control-plane v0.14.0
go: downloading github.com/envoyproxy/protoc-gen-validate v1.3.3
go: downloading github.com/go-zookeeper/zk v1.0.3
go: downloading github.com/kr/pretty v0.3.1
go: downloading github.com/Azure/go-autorest/autorest/date v0.3.0
go: downloading github.com/Azure/go-autorest/autorest/to v0.4.0
go: downloading github.com/Azure/go-autorest/autorest/validation v0.3.1
go: downloading github.com/Azure/go-autorest/tracing v0.6.0
go: downloading github.com/Azure/go-autorest/logger v0.2.1
go: downloading github.com/golang-jwt/jwt/v4 v4.2.0
go: downloading github.com/hashicorp/go-cleanhttp v0.5.2
go: downloading github.com/hashicorp/go-hclog v0.16.2
go: downloading github.com/hashicorp/go-rootcerts v1.0.2
go: downloading github.com/hashicorp/serf v0.10.1
go: downloading github.com/mitchellh/mapstructure v1.5.0
go: downloading github.com/google/go-querystring v1.1.0
go: downloading golang.org/x/tools v0.48.0
go: downloading github.com/google/gofuzz v1.2.0
go: downloading k8s.io/klog/v2 v2.80.1
go: downloading k8s.io/klog v1.0.0
go: downloading k8s.io/utils v0.0.0-20221128185143-99ec85e7a448
go: downloading sigs.k8s.io/structured-merge-diff/v4 v4.2.3
go: downloading github.com/imdario/mergo v0.3.12
go: downloading github.com/spf13/pflag v1.0.5
go: downloading golang.org/x/term v0.45.0
go: downloading github.com/go-resty/resty/v2 v2.1.1-0.20191201195748-d7b97669fe48
go: downloading gopkg.in/ini.v1 v1.66.6
go: downloading github.com/docker/go-connections v0.4.0
go: downloading github.com/docker/go-units v0.5.0
go: downloading github.com/opencontainers/image-spec v1.0.2
go: downloading github.com/docker/distribution v2.8.1+incompatible
go: downloading github.com/opencontainers/go-digest v1.0.0
go: downloading github.com/gorilla/websocket v1.5.0
go: downloading github.com/hashicorp/cronexpr v1.1.1
go: downloading github.com/hashicorp/go-retryablehttp v0.7.1
go: downloading github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2
go: downloading github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
go: downloading github.com/oklog/ulid v1.3.1
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0
go: downloading github.com/kr/text v0.2.0
go: downloading github.com/rogpeppe/go-internal v1.14.1
go: downloading github.com/fatih/color v1.13.0
go: downloading github.com/mattn/go-colorable v0.1.12
go: downloading github.com/mattn/go-isatty v0.0.14
go: downloading github.com/mitchellh/go-homedir v1.1.0
go: downloading github.com/armon/go-metrics v0.3.10
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd
go: downloading github.com/json-iterator/go v1.1.12
go: downloading github.com/google/gnostic v0.5.7-v3refs
go: downloading github.com/sirupsen/logrus v1.8.1
go: downloading github.com/Microsoft/go-winio v0.5.1
go: downloading github.com/golang/snappy v0.0.4
go: downloading gonum.org/v1/gonum v0.17.0
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading github.com/jmespath/go-jmespath/internal/testify v1.5.1
go: downloading github.com/hashicorp/go-immutable-radix v1.3.1
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.2
go: downloading k8s.io/kube-openapi v0.0.0-20221207184640-f3cff1453715
go: downloading sigs.k8s.io/yaml v1.3.0
go: downloading github.com/hashicorp/golang-lru v0.5.4
go: downloading github.com/emicklei/go-restful/v3 v3.9.0
go: downloading github.com/go-openapi/swag v0.22.3
go: downloading github.com/go-openapi/jsonreference v0.20.0
go: downloading github.com/mailru/easyjson v0.7.7
go: downloading github.com/go-openapi/jsonpointer v0.19.5
go: downloading github.com/josharian/intern v1.0.0
go: github.com/libops/cap/scraper imports
	github.com/prometheus/prometheus/config tested by
	github.com/prometheus/prometheus/config.test imports
	github.com/prometheus/prometheus/discovery/dns imports
	github.com/miekg/dns imports
	golang.org/x/tools/go/packages: golang.org/x/tools@v0.48.0: read "https://proxy.golang.org/golang.org/x/tools/@v/v0.48.0.zip": stream error: stream ID 167; INTERNAL_ERROR; received from peer