chore(deps): golang.org/x/crypto v0.53.0

[thaJeztah]

golang.org/x/crypto v0.52.0 has various fixes for vulnerabilities. These do NOT impact docker compose, but may show up in vulnerability scanners;

govulncheck --version
Go: go1.26.4
Scanner: govulncheck@v1.3.0
DB: https://vuln.go.dev
DB updated: 2026-06-02 21:39:47 +0000 UTC
govulncheck -show verbose ./...
Fetching vulnerabilities from the database...
Checking the code against the vulnerabilities...
=== Package Results ===
Vulnerability #1: GO-2026-5023
Invoking VerifiedPublicKeyCallback permissions skip enforcement in
golang.org/x/crypto/ssh
More info: https://pkg.go.dev/vuln/GO-2026-5023
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #2: GO-2026-5020
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
More info: https://pkg.go.dev/vuln/GO-2026-5020
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #3: GO-2026-5019
Invoking bypass of FIDO/U2F security keys physical interaction in
golang.org/x/crypto/ssh
More info: https://pkg.go.dev/vuln/GO-2026-5019
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #4: GO-2026-5018
Invoking pathological RSA/DSA parameters may cause DoS in
golang.org/x/crypto/ssh
More info: https://pkg.go.dev/vuln/GO-2026-5018
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #5: GO-2026-5017
Invoking client can cause server deadlock on unexpected responses in
golang.org/x/crypto/ssh
More info: https://pkg.go.dev/vuln/GO-2026-5017
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #6: GO-2026-5016
Invoking memory leak when rejecting channels can lead to DoS in
golang.org/x/crypto/ssh
More info: https://pkg.go.dev/vuln/GO-2026-5016
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #7: GO-2026-5015
Invoking server panic during CheckHostKey/Authenticate in
golang.org/x/crypto/ssh
More info: https://pkg.go.dev/vuln/GO-2026-5015
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #8: GO-2026-5014
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
More info: https://pkg.go.dev/vuln/GO-2026-5014
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #9: GO-2026-5013
Invoking byte arithmetic causes underflow and panic in
golang.org/x/crypto/ssh
More info: https://pkg.go.dev/vuln/GO-2026-5013
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
=== Module Results ===
Vulnerability #1: GO-2026-5033
Invoking pathological inputs can lead to client panic in
golang.org/x/crypto/ssh/agent
More info: https://pkg.go.dev/vuln/GO-2026-5033
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #2: GO-2026-5021
Invoking auth bypass via unenforced @revoked status in
golang.org/x/crypto/ssh/knownhosts
More info: https://pkg.go.dev/vuln/GO-2026-5021
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #3: GO-2026-5006
Invoking agent constraints dropped when forwarding keys in
golang.org/x/crypto/ssh/agent
More info: https://pkg.go.dev/vuln/GO-2026-5006
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Vulnerability #4: GO-2026-5005
Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
More info: https://pkg.go.dev/vuln/GO-2026-5005
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.51.0
Fixed in: golang.org/x/crypto@v0.52.0
Your code is affected by 2 vulnerabilities from 1 module.
This scan also found 9 vulnerabilities in packages you import and 4
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.

What I did

Related issue

(not mandatory) A picture of a cute animal, if possible in relation to what you did

[Copilot]

Pull request overview

This PR updates Go module dependencies to address vulnerability scanner findings by upgrading golang.org/x/crypto (and related golang.org/x/* modules) in the Compose v5 Go module.

Changes:

• Bump golang.org/x/crypto from v0.51.0 to v0.53.0 (indirect).
• Bump golang.org/x/term to v0.44.0 and golang.org/x/text to v0.38.0 (indirect).
• Refresh go.sum entries accordingly (including transitive updates such as golang.org/x/mod).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
go.mod	Updates indirect golang.org/x/* module versions (crypto/term/text) to newer releases.
go.sum	Updates checksums to match the upgraded module versions and their transitive dependencies.

[docker-agent]

Assessment: 🟢 APPROVE

This dependency bump upgrades golang.org/x/crypto from v0.51.0 to v0.53.0, addressing multiple CVEs in golang.org/x/crypto/ssh (GO-2026-5013 through GO-2026-5023) and related module-level vulnerabilities. Transitive bumps to golang.org/x/term, golang.org/x/text, and golang.org/x/mod are also included.

The go.mod and go.sum changes are internally consistent: all new versions have correct h1 and go.mod hash entries in go.sum, old version entries are cleanly removed, and no stale or duplicate entries remain. No bugs or data-integrity issues were found in the changed lines.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!