fix(deps): update golang.org/x/crypto

[ashmckenzie]

Description

Updates golang.org/x/crypto to v0.56.0 to remediate GO-2026-6354 and GO-2026-6355, which affect the CLI's SSH client path. Because v0.56.0 requires Go 1.26, this also aligns the module minimum with the repository's existing Go 1.26.6 toolchain.

Go 1.25 was EOL'd 19th August 2026.

Changes

• Upgrade golang.org/x/crypto from v0.55.0 to v0.56.0.
• Raise the module's minimum Go version from 1.25 to 1.26.

Testing

• Tests have run locally (with go test ./...)
• Code is formatted (with go fmt ./...)

mise run vulncheck, mise run lint, and go mod verify also pass.

Disclosures / Credits

Amp diagnosed the linked Buildkite failure, prepared the dependency update, and ran the verification commands under Ash McKenzie's direction.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​crypto@​v0.55.0 ⏵ v0.56.0	+1

View full report

[buildsworth-bk-app]

The module metadata, checksums, and pinned toolchain line up; there’s one stale compatibility note inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 25499, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-5.6-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. Unless repository policy already allows L2 approval, grant it by mentioning @buildsworth-bk (see approval ceiling and L2 approval grant):

• L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
• L2 — Standard risk (new UI, additive API fields, refactors). Approved only when repository policy or a verified grant allows it; otherwise comment-only.
• L3 — High risk (auth, migrations, payments, secrets, perf-critical pipeline paths). Human review always required.

[ashmckenzie]

The GO-2026-6354 and GO-2026-6355 fixes require a Go 1.25 -> 1.26 bump which isn't ideal but necessary.

[PriyaSudip]

Thanks for adding this change :)