deps: clear the thirteen fixable advisories Scorecard reports, by version bump only

[distronode-com]

Scorecard's Vulnerabilities check reports fifteen advisories against this tree. Thirteen clear with version bumps. The other two have no fixed release, so no bump can clear them (see below). None of the fifteen is reachable in this codebase, so this is housekeeping rather than a fix for a live problem.

Advisory	Package	From	To
GO-2026-6303, GO-2026-6354, GO-2026-6355	golang.org/x/crypto	v0.53.0	v0.56.0
GHSA-29g2-3rmr-qm68, GHSA-866w-xmhq-wj7x, GHSA-wqjv-9729-c5q2	@sveltejs/kit	2.65.1	2.70.3
GHSA-p63j-vcc4-9vmv	@vitest/browser (+ vitest, @vitest/browser-playwright, which peer-pin each other exactly)	4.1.9	4.1.11
GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849	postcss (transitive)	8.5.15	8.5.28
GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8	nanoid (transitive)	3.3.12	3.3.19
GHSA-pxg6-pf52-xh8x	cookie (transitive, via Kit)	0.6.0	0.7.2

Why none of them bites here: the three x/crypto advisories are in ssh, and this tree imports only bcrypt and argon2; the three Kit advisories are in its server runtime, which never runs under adapter-static (the built SPA is embedded and served by Go); @vitest/browser is test-only; postcss and nanoid are build-time.

Not cleared, and Scorecard will keep listing them after merge:

• GO-2026-5932, golang.org/x/crypto/openpgp (unmaintained, "Fixed in: N/A"). With no fixed release it stays present at module level on v0.56.0. Nothing in this tree imports openpgp; govulncheck reports 0 vulnerabilities in called code.
• GHSA-q7pp-wcgr-pffx, disintegration/imaging, no fixed release. Unreachable, since every upload goes through decodeUploadedImage's content-type sniff before imaging.Fit ever sees a decoded image.

Two things worth a look:

• cookie needed a pnpm overrides entry ("cookie@^0.6.0": "^0.7.2"), because Kit 2.70.3 still declares ^0.6.0 and for a 0.x version that caret cannot reach 0.7. It is scoped to that range so msw's cookie@1.1.1 is untouched, and it should go the moment Kit widens its own range. If you would rather not carry an override, dropping that hunk leaves one LOW advisory open and nothing else changes.
• go.mod's directive moves from go 1.26 to go 1.26.0. This is required by the bump, not tidying: x/crypto v0.56.0 declares go 1.26.0, and with go 1.26 restored every go command stops with "updates to go.mod needed" (go build ./... exits 1). Same language version, spelled out.

go mod tidy moved nothing else.

Verified: pnpm audit reports no known vulnerabilities; pnpm build and pnpm test:visual (5/5 in Chromium) pass; go build, go vet and the keyvault and handler test packages pass; govulncheck ./... reports 0 vulnerabilities in called code.

🤖 Generated with Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes Version-only dependency bumps to clear Scorecard Vulnerabilities noise where a fixed release exists. No application code changes.

• golang.org/x/crypto → v0.56.0 (and go 1.26 → go 1.26.0 for the module’s declared language form). Clears the three ssh advisories; this tree only imports bcrypt/argon2.
• @sveltejs/kit → 2.70.3 (lock), vitest browser stack → 4.1.11, plus transitive postcss/nanoid refreshes. SPA stays on adapter-static.
• Scoped pnpm override cookie@^0.6.0 → ^0.7.2 so Kit’s 0.x caret can reach the patched line without touching msw’s cookie@1.1.1.

Verified here: pnpm audit clean, pnpm build OK, go build/vet and keyvault/handler tests pass, govulncheck reports 0 symbol-level hits.

ℹ️ Title/body slightly overstates GO-2026-5932 clearance

The crypto bump is right for GO-2026-6303 / 6354 / 6355. GO-2026-5932 (x/crypto/openpgp) has no fixed release (Fixed in: N/A) and still shows as a module-level finding on v0.56.0 under govulncheck -show verbose. Same class as the imaging entry you correctly left alone: Scorecard may keep listing it after merge even though nothing in this tree calls openpgp. Worth a one-line PR-body tweak so the “fourteen cleared” claim matches what Scorecard will still see (openpgp + imaging).

Technical details

# GO-2026-5932 is not cleared by x/crypto v0.56.0

## Affected sites
- PR description table lists GO-2026-5932 under “From → To” as cleared by the crypto bump
- `golang.org/x/crypto@v0.56.0` still carries GO-2026-5932 at module level (openpgp, all versions)

## Required outcome
- PR title/body should not claim GO-2026-5932 is resolved by this bump; treat it like imaging (unfixed, unreachable)

## Suggested approach (optional)
- Drop GO-2026-5932 from the “cleared” table; note it remains as an unfixed module-level advisory with no call path

  ^{｜ View workflow run ｜ Using Grok ｜ 𝕏}

[shockalotti]

Bumps themselves look right and CI is green. I verified the tree with govulncheck ./... on this head: 0 reachable vulnerabilities, which is the outcome that matters. But the PR's headline claim needs correcting before merge:

GO-2026-5932 is not cleared by this bump and cannot be. Verbose output:

Vulnerability #1: GO-2026-5932 — the golang.org/x/crypto/openpgp package is unmaintained, unsafe by design ... Module: golang.org/x/crypto ... Found in: golang.org/x/crypto@v0.56.0 ... Fixed in: N/A

Our code doesn't call openpgp (govulncheck confirms: "0 vulnerabilities in packages you import" for called code), so this is unreachable-but-present. Since Scorecard flags at module level, it will likely keep reporting this one after merge — so "clear the fourteen advisories by version bump only" delivers thirteen. Please correct the table row: mark GO-2026-5932 as unfixable-but-uncalled rather than cleared, and adjust the title/body accordingly.

Small second ask: the diff also flips go 1.26 → go 1.26.0 in go.mod (semantically nil, presumably a tidy artifact). In a "bump only" PR I'd revert that hunk to keep the diff to exactly the version bumps.

[distronode-com]

You're right about GO-2026-5932, thanks. The title and description now say thirteen: GO-2026-5932 (x/crypto/openpgp) and GHSA-q7pp-wcgr-pffx (imaging) have no fixed release, nothing here calls either, and Scorecard will keep listing both after merge. govulncheck -show verbose ./... on this head gives me the same result you got: 0 vulnerabilities in called code, and GO-2026-5932 only as a module-level finding.

On the go 1.26 → go 1.26.0 hunk: I'd like to keep it, because it isn't a tidy artifact. The bump doesn't build without it. golang.org/x/crypto v0.56.0's own go.mod declares go 1.26.0, and a module's go line can't be lower than a dependency's (1.26 sorts below 1.26.0). With go 1.26 restored on this branch:

$ go build ./...
go: updates to go.mod needed; to update it:
	go mod tidy
(exit 1)

go vet fails the same way, and go mod tidy -diff puts go 1.26.0 straight back. With the hunk left in, go build ./... exits 0. So the change is part of the version bump, not an extra beside it. The description now says that more plainly.

[shockalotti]

Approved — the revision addresses the substance: body now says thirteen fixable with the two unfixable called out, matching what govulncheck reports on this head (0 reachable, GO-2026-5932 present-but-uncalled with no fixed release). Waiving my own go-directive nit: the surviving go 1.26 → 1.26.0 hunk is semantically nil and what current toolchains write; not worth another round-trip.