fix(deps): bump golang.org/x/crypto to v0.56.0

[dilverse]

Problem

golang.org/x/crypto v0.55.0 carries two ssh advisories, GO-2026-6355 and
GO-2026-6354 (deadlocked established/undecided channel DoS). Both are fixed
in v0.56.0. govulncheck fails CI on any branch that reaches this code path,
including unrelated PRs such as #258.

Fix

• Bump golang.org/x/crypto v0.55.0 → v0.56.0 in go.mod/go.sum.
• v0.56.0 requires go 1.26.0, so the module's go directive moves up to
  match.

Test plan

• make test (lint + go test -race -tags kqueue ./...) → 0 lint
  issues, all packages pass.
• govulncheck ./... → GO-2026-6355 and GO-2026-6354 no longer reported.
• go build ./... → success.

https://claude.ai/code/session_01XG59JYqzTNccq2ve4pRTfk

[coderabbitai]

Warning

Review limit reached

Next included review available in 41 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1d8378e3-6bb0-46b4-8903-2e2988ce66f2

📥 Commits

Reviewing files that changed from the base of the PR and between 244ac8d and db2adc7.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

The repo’s Go workflow still includes Go 1.25.x in its test matrix, which will fail once go.mod requires Go 1.26.0.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the module to address reported golang.org/x/crypto/ssh vulnerabilities by bumping golang.org/x/crypto to v0.56.0, and raises the module Go version to satisfy the new dependency’s minimum Go requirement.

Changes:

• Bump golang.org/x/crypto from v0.55.0 to v0.56.0.
• Update the module go directive from 1.25.0 to 1.26.0.
• Refresh go.sum entries for the updated dependency.

File summaries

File	Description
go.mod	Raises module Go version to 1.26.0 and bumps golang.org/x/crypto to v0.56.0.
go.sum	Updates checksum entries to match golang.org/x/crypto v0.56.0.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.