chore(deps): bump golang.org/x/crypto v0.55.0 -> v0.56.0 (govulncheck)

[hsinatfootprintai]

Summary

govulncheck started failing on every open PR after the vulnerability DB picked up two advisories against golang.org/x/crypto@v0.55.0's ssh.NewClientConn path (GO-2026-6354, GO-2026-6355) — both fixed in v0.56.0. Unrelated to any of the Phase 1 (#1682) work in flight; found while trying to merge #1687, which doesn't touch this dependency.

The CI gate only fails when a reported vulnerability has an actual available fix:

if grep "Fixed in:" govulncheck-output.txt | grep -qv "N/A"; then exit 1; fi

Everything else currently reported — several github.com/lxc/incus/v6 CVEs, one golang.org/x/crypto/openpgp advisory — shows Fixed in: N/A (no upstream fix exists yet), so it doesn't block and this bump doesn't touch it.

Verification

Ran locally after the bump:

govulncheck -show verbose ./...

Zero Fixed in: lines that aren't N/A — the exact condition the CI gate checks. go.sum churn is minimal (2 lines), no cascading dependency bumps.

Test evidence

go build ./..., go vet ./..., gofmt -l — clean. go test ./... — green except the same two pre-existing test/integration failures every run in this sandbox hits (need a live daemon + real TLS certs, unrelated to this change).

This should merge ahead of #1687/#1684/#1686/#1688 so they inherit the fix on their next rebase.

Summary by CodeRabbit

• Chores
  • Updated the cryptography dependency to version 0.56.0.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: e88cd680-90df-47e6-b7c5-aca4b49ddfa2

📥 Commits

Reviewing files that changed from the base of the PR and between 2f3d86c and be77549.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The direct golang.org/x/crypto dependency is upgraded from v0.55.0 to v0.56.0 in go.mod.

Changes

Crypto dependency update

Layer / File(s)	Summary
Upgrade crypto module requirement go.mod	The direct golang.org/x/crypto requirement changes from v0.55.0 to v0.56.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to be775

This is a localized dependency update with no actionable merge-blocking risk remaining after normal checks and review.

Suggested reviewers: hsinhoyeh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the dependency update from v0.55.0 to v0.56.0 and indicates its security purpose.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1687-govulncheck-x-crypto

---

_{Comment @coderabbitai help to get the list of available commands.}