chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.57.0

[dependabot]

Bumps golang.org/x/crypto from 0.54.0 to 0.57.0.

Commits

• 3f62bf1 go.mod: update golang.org/x dependencies
• 86efde5 ssh: reject unexpected message types on established channels
• a6cdac6 ssh: drop traffic on undecided channels
• 39dc44e ssh: don't skip the source-address critical option in CheckCert
• afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
• 89f4e9b x509roots/fallback: update bundle
• 71488c4 ssh/knownhosts: compare only public key portions for revocation
• 82adefa ssh: synchronize unexpected response test
• c757c98 all: upgrade go directive to at least 1.26.0 [generated]
• 593c81a ssh: correctly ignore pre-banner lines
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[bodaay]

@dependabot rebase

[bodaay]

Holding this PR — it needs a deliberate Go 1.26 upgrade first.

golang.org/x/crypto v0.57.0 requires Go 1.26, so this PR also changes go.mod from go 1.25.14 to go 1.26.0. That has three consequences:

• Docker Build fails. The Dockerfile builds with golang:1.25-alpine, so go mod download cannot satisfy go 1.26.0.
• govulncheck fails. Go 1.26.0 itself has 24 known standard-library vulnerabilities that our code reaches. The directive should be the latest 1.26.x patch, not .0.
• The scanner pin must move too. govulncheck is pinned to v1.7.0 because v1.8.0+ needs Go 1.26. It should move to the latest version as part of the upgrade.

To unblock: do one PR that bumps go.mod to the latest 1.26.x, the Dockerfile builder to golang:1.26-alpine, and govulncheck to the latest version. Then @dependabot rebase this one.

🤖 Generated with Claude Code

[bodaay]

@dependabot rebase

[bodaay]

Superseded: golang.org/x/crypto 0.57.0 is applied in the PR that also removes Dependabot (the project now does monthly manual dependency checks — see docs/MAINTENANCE.md).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.