chore(deps): update module golang.org/x/crypto to v0.56.0 [security]

[NumaryBot]

This PR contains the following updates:

Package	Type	Update	Change
golang.org/x/crypto	indirect	minor	v0.55.0 -> v0.56.0

---

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

CVE-2026-78662 / GO-2026-6354

More information

Details

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.

Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

Severity

Unknown

References

• https://go.dev/issue/81316
• https://go.dev/cl/826504
• https://groups.google.com/g/golang-announce/c/1y3fb2np35U

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

CVE-2026-56855 / GO-2026-6355

More information

Details

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.

Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

Severity

Unknown

References

• https://go.dev/issue/81317
• https://go.dev/cl/826524
• https://groups.google.com/g/golang-announce/c/1y3fb2np35U

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[NumaryBot]

✅ Approve — automated review

The dependency version and corresponding checksums are updated consistently. No regressions or dependency inconsistencies are evident.

No findings.

[shipfox-ai]

This PR is a minimal, self-consistent dependency bump of the indirect dependency golang.org/x/crypto from v0.55.0 to v0.56.0 in the deployment/operator module, motivated by security fixes in golang.org/x/crypto/ssh. I independently verified the change against the checkout: deployment/operator/go.mod:106 now declares golang.org/x/crypto v0.56.0 // indirect, deployment/operator/go.sum:279-280 carry the corresponding v0.56.0 h1: and /go.mod hashes, the v0.55.0 hash lines were removed, and a repo-wide search finds no stale v0.55.0 references and no other module declaring x/crypto. No Go source is touched, and no direct imports of the package exist in this module. The diff implements exactly what the PR body's update table requires, with no missing work, no scope creep, and no incorrect implementation. Recommendation: approve.

Standards

No confirmed material finding. The diff contains only a version-string bump and its mandatory go.sum hash consequences, all generated by the Go toolchain; it violates no documented repo standard and triggers no baseline smell.

Spec

No confirmed material finding. The change matches the PR body's single requirement (golang.org/x/crypto, indirect, v0.55.0 -> v0.56.0) precisely: both go.sum hash lines were replaced consistently, the old version's hashes are gone, and the three-dot diff touches exactly the two files the update requires.

Reviewed independently by GLM (glm-5.3-flash) and DeepSeek (deepseek-v4-pro-0813) via Shipfox; verified and synthesized by GLM.