chore(deps): upgrade golang.org/x/crypto to v0.55.0

[appleboy]

Summary

The daily Trivy Security Scan workflow on the default branch has been failing because golang.org/x/crypto v0.54.0 is affected by CVE-2026-56854 (CRITICAL, golang.org/x/crypto/ssh).

• Bump golang.org/x/crypto to v0.55.0 in every go.mod of this repository (including example modules).
• go mod tidy refreshed the transitive golang.org/x/* versions that v0.55.0 requires. Only go.mod / go.sum files changed.

CI fix: SARIF scan ignored the severity filter

The vulnerability-scanning job in .github/workflows/testing.yml runs trivy with format: sarif, severity: CRITICAL,HIGH and exit-code: 1. trivy-action unsets TRIVY_SEVERITY for SARIF output unless limit-severities-for-sarif: true is set, so the job failed on any finding. After this bump, golang.org/x/crypto v0.55.0 still carries two UNKNOWN-severity advisories (CVE-2026-56855, CVE-2026-78662, fixed in v0.56.0, which requires Go 1.26), and those alone made the job fail. This PR adds limit-severities-for-sarif: true so the job enforces the CRITICAL/HIGH gate it was configured for.

Related issues

• Jira: N/A
• GitHub: N/A (fixes the failing scheduled Trivy Security Scan workflow)

AI authorship

• No AI was used
• AI was used
  • Tool / model: Claude Code (Claude Fable 5.1)
  • AI-authored files: all go.mod / go.sum files in this PR (generated with go get + go mod tidy), .github/workflows/testing.yml
  • Human line-by-line reviewed: None — not yet reviewed by a human.

Change classification

• Leaf change
• Core change

Dependency bump plus a one-line CI workflow change; no source code changed.

Plan reference

Goal: make the Trivy Security Scan workflow pass on the default branch by upgrading the vulnerable dependencies to their fixed versions. Scope: go.mod / go.sum and the trivy step in .github/workflows/testing.yml.

Verification

• Automated:
  • trivy fs --scanners vuln,secret,misconfig --severity CRITICAL,HIGH,MEDIUM --ignore-unfixed --exit-code 1 . (same flags as CI, vulnerability DB dated 2026-09-05): pass, 0 findings
  • go build ./... in every module: pass
  • go test ./... in the root module: pass for unit tests
• Manual: none
• Not run: tests that require external services (Redis / memcached / MongoDB) were not run locally; they are covered by CI.

Security check

• No secrets in the diff
• External inputs are validated
• Permission checks are tested
• Errors do not leak internals
• N/A - no external or security-sensitive interface changed

Risk and rollback

• Risk: minimal; minor-version bumps of Go standard extension packages with no API changes used by this repo.
• Rollback: revert this commit.

Reviewer guide

• Read carefully: the limit-severities-for-sarif: true line in .github/workflows/testing.yml; version numbers in go.mod.
• Spot-check: go.sum hash updates are mechanical output of go mod tidy.

[Copilot]

🟢 Approval recommended

Only go.mod/go.sum were changed and the repository no longer references the vulnerable golang.org/x/crypto v0.54.0.

Pull request overview

Updates the root Go module dependency set to remediate a Trivy-reported vulnerability by bumping golang.org/x/crypto to v0.55.0, along with the transitive golang.org/x/text update produced by go mod tidy.

Changes:

• Bumped golang.org/x/crypto from v0.54.0 to v0.55.0 in go.mod.
• Refreshed go.sum hashes for golang.org/x/crypto and golang.org/x/text to match the updated module graph.

File summaries

File	Description
go.mod	Updates indirect golang.org/x/* dependency versions, including x/crypto → v0.55.0.
go.sum	Updates module checksums to align with the new go.mod resolution (tidy output).

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.