chore(deps): update module golang.org/x/crypto to v0.56.0 [security]

[NumaryBot]

This PR contains the following updates:

Package	Type	Update	Change
golang.org/x/crypto	indirect	minor	v0.55.0 -> v0.56.0

---

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

CVE-2026-56855 / GO-2026-6355

More information

Details

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.

Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Severity

Unknown

References

• https://go.dev/issue/81317
• https://go.dev/cl/826524
• https://groups.google.com/g/golang-announce/c/1y3fb2np35U

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

CVE-2026-78662 / GO-2026-6354

More information

Details

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.

Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Severity

Unknown

References

• https://go.dev/issue/81316
• https://go.dev/cl/826504
• https://groups.google.com/g/golang-announce/c/1y3fb2np35U

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[NumaryBot]

ℹ Artifact update notice

File name: deployments/pulumi/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.0 -> 1.26.0

[NumaryBot]

✅ Approve — automated review

The dependency versions and checksums are updated consistently across the affected Go modules. No actionable regressions were found.

No findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.49%. Comparing base (e56b43c) to head (776248c).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1867      +/-   ##
==========================================
+ Coverage   81.39%   81.49%   +0.10%     
==========================================
  Files         206      206              
  Lines       11356    11356              
==========================================
+ Hits         9243     9255      +12     
+ Misses       1557     1556       -1     
+ Partials      556      545      -11     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[shipfox-ai]

This PR is a Renovate security bump of golang.org/x/crypto from v0.55.0 to v0.56.0, touching only manifest and lockfile lines across the four Go modules (root, tools/provisioner, tools/generator, deployments/pulumi). I verified the diff and the resulting tree: every module that declared the dependency at v0.55.0 now declares v0.56.0, all four go.sum files carry identical v0.56.0 h1://go.mod hashes, no v0.55.0 references remain, and the accompanying go 1.26.0 directive change in deployments/pulumi/go.mod aligns that module with the other modules' existing go 1.26.0 directives. The change is internally consistent and correctly scoped. Recommendation: approve.

Standards

No confirmed material finding. The commit message (chore(deps): update module golang.org/x/crypto to v0.56.0 [security]) follows the documented conventional-commit format, no layout or generated-file standards are implicated (no Go source changed), and the diff is free of actionable smells. Two candidate observations were reviewed and rejected: (1) the renovate/security branch name deviates from CLAUDE.md's branch prefixes, but it is machine-generated by Renovate, lies outside the diff, and has no correctness, security, or compatibility impact; (2) the go 1.25.0 → 1.26.0 directive change in deployments/pulumi/go.mod is not an unrelated bundled change — it aligns that module with the root and tool modules, which already sit at go 1.26.0, and is the documented artifact-update behavior of the bump.

Spec

No confirmed material finding. The PR body's stated requirement — upgrade golang.org/x/crypto (indirect) from v0.55.0 to v0.56.0 — is fully satisfied in every module that carried the dependency, with consistent hashes across all four go.sum files and no leftover v0.55.0 references anywhere in the tree. The only change beyond the version bump is the documented go directive update in deployments/pulumi/go.mod, which is a compatibility consequence of the bump, not scope creep.

Reviewed independently by GLM (glm-5.3-flash) and DeepSeek (deepseek-v4-pro-0813) via Shipfox; verified and synthesized by GLM.