chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0

[dependabot]

Bumps golang.org/x/crypto from 0.51.0 to 0.52.0.

Commits

• a1c0d99 go.mod: update golang.org/x dependencies
• 3c7c869 ssh: fix deadlock on unexpected channel responses
• 533fb3f ssh: fix source-address critical option bypass
• abbc44d ssh: fix incorrect operator order
• e052873 ssh: fix infinite loop on large channel writes due to integer overflow
• b61cf85 ssh: enforce user presence verification for security keys
• 9c2cd33 ssh: enforce strict limits on DSA key parameters
• 8907318 ssh: reject RSA keys with excessively large moduli
• ffd87b4 ssh: fix panic when authority callbacks are nil
• 4e7a738 ssh: fix deadlock on unexpected global responses
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cnjack]

Review

This is a pure dependency bump (golang.org/x/crypto 0.51.0 → 0.52.0) — only go.mod/go.sum changed, no application code. I checked how the repo actually uses this package before signing off, since internal/remote/ssh.go, internal/tools/ssh_auth.go, and internal/tools/env.go all depend on golang.org/x/crypto/ssh for the app's outbound SSH client (agent auth, id_rsa/id_ed25519/id_ecdsa key files, explicit key/password auth).

What changed upstream

The 0.52.0 release includes several real ssh package fixes: a source-address critical-option bypass, an integer-overflow-driven infinite loop on large channel writes, two deadlocks on unexpected channel/global responses, a nil-callback panic, plus new strict limits on DSA parameters and RSA modulus size, and enforced user-presence checks for security keys.

Findings

No correctness, reliability, or security defects found in this change itself — I don't have >80% confidence in any specific regression. Two things worth being aware of operationally rather than blocking on:

• The new RSA-modulus/DSA-parameter limits and security-key presence enforcement are behavior changes in the upstream ssh package, not bugs in this PR. In principle they could reject a pre-existing key/agent setup that was previously accepted (e.g., an unusually large RSA key), but this only affects users with such keys and is the correct, safer behavior — not something to hold this PR for.
• The Go (build · vet · test · lint) check was still in progress as of this review; worth confirming it's green before merge given three files in this codebase exercise the ssh package directly.

Overall Risk

Low

Top Findings

None — this is a routine, security-positive dependency update with no application code touched. Safe to merge once CI is green.

---

Generated by Claude Code