[aikido-autofix]

Upgrade golang.org/x/crypto to fix connection deadlock vulnerabilities (DoS) caused by malicious peers flooding unestablished channels and sending crafted messages on established channels.

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-78662	HIGH	[golang.org/x/crypto] A malicious peer could flood unestablished channels with requests, causing a deadlock that freezes the entire connection. The fix adds an atomic established state to drop non-confirmation packets on unestablished channels without blocking.
CVE-2026-56855	HIGH	[golang.org/x/crypto] A malicious peer could send crafted messages after establishing a channel, causing a deadlock that freezes the entire connection. The vulnerability has been fixed by properly handling RFC 4254 channel messages and treating unrecognized messages as protocol errors to terminate the connection.

[Copilot]

🟡 Changes recommended

The go directive version bump in go.mod is a repo-wide toolchain change not described in the PR’s stated scope and should be reverted or explicitly justified.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the repository’s Go dependencies to address reported deadlock/DoS vulnerabilities in golang.org/x/crypto by upgrading it from v0.55.0 to v0.56.0.

Changes:

• Bumps golang.org/x/crypto indirect dependency to v0.56.0 in go.mod.
• Updates go.sum entries to match the new x/crypto version.
• Also updates the module go directive (Go toolchain version) in go.mod, which is broader in scope than the PR’s stated dependency-only security upgrade.

File summaries

File	Description
go.mod	Upgrades golang.org/x/crypto and bumps the module go version directive.
go.sum	Refreshes checksum entries for golang.org/x/crypto v0.56.0.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.