fix(deps): bump golang.org/x/crypto to v0.55.0 for CVE-2026-56854

[kparkinson-ld]

Bumps golang.org/x/crypto from v0.53.0 to v0.55.0 to clear HIGH CVE-2026-56854, newly flagged by Docker Scout against v8 base source (currently failing on PRs #841–#847).

• golang.org/x/crypto v0.53.0 → v0.55.0 (fix version for CVE-2026-56854, affected < 0.55.0)
• Required transitive golang.org/x/* bumps only: net v0.56.0 → v0.57.0, sync v0.21.0 → v0.22.0, sys v0.46.0 → v0.47.0, text v0.39.0 → v0.41.0
• No source changes, no other dependencies touched, no Docker Scout configuration changed
• v0.55.0 requires Go 1.25.0; go.mod already declares go 1.25.10

Requirements

• I have added test coverage for new or changed functionality — n/a, dependency-only change covered by existing suite
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Implementation details and validation

Change mechanism

Applied with Go tooling only:

go get golang.org/x/crypto@v0.55.0
go mod tidy

git diff --stat is limited to go.mod (10 lines) and go.sum (28 lines). The x/net, x/sync, x/sys, and x/text bumps are the minimum-version-selection consequences of the x/crypto requirement graph, not discretionary upgrades.

Validation

• go build ./... — clean
• make lint (golangci-lint v2.13.1) — 0 issues
• make test — all packages pass except one timing-sensitive assertion in internal/metrics, TestStreamDurationIsNotAffectedByActivityCounts ("stream time should be approximately 10ms"), which is load-dependent: re-running it with -count=5 passes both on this branch and on the unmodified v8 base commit, so it is not caused by this change.

Scope notes

This is a newly detected vulnerability in dependency source that was already present on the unchanged v8 base — not a regression introduced by PRs #841–#847, and not a flaky scanner result. Merging this to v8 should clear the Docker Scout check for those PRs once they pick up the base.

Alternatives considered

Suppressing or downgrading the Docker Scout policy, or pinning only the indirect graph — both rejected: the CVE has an upstream fixed version that the current Go toolchain requirement already supports, so the direct upgrade is the correct remediation.

Link to Devin session: https://app.devin.ai/sessions/8343658d95954c098ee39e4a10b3883f
Open in Devin Desktop: https://app.devin.ai/desktop/session/8343658d95954c098ee39e4a10b3883f?variant=devin
Requested by: @kparkinson-ld

---

Note

Overview
Dependency-only security remediation with no application source changes—only go.mod and go.sum are updated.

The primary change bumps golang.org/x/crypto from v0.53.0 to v0.55.0 to address CVE-2026-56854 (Docker Scout / HIGH), which affects versions below 0.55.0.

Go’s module resolution also updates the minimum compatible golang.org/x/* versions: sync v0.21.0 → v0.22.0 (direct), and indirect net, sys, and text to v0.57.0, v0.47.0, and v0.41.0 respectively, with matching checksum entries in go.sum.

^{Reviewed by Cursor Bugbot for commit 9ca42d6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring