chore(deps): bump the gomod group across 1 directory with 15 updates - #731

Kusari Analysis Results:

While the code analysis found zero security issues across all scanned files, the dependency analysis identified critical vulnerabilities that we strongly recommend addressing before merging. The PR upgrades golang.org/x/crypto to v0.46.0, but this version still carries 13 active security advisories including authentication bypasses (CVE-2026-39828, CVE-2026-42508, CVE-2026-46595), denial-of-service via memory leaks (CVE-2026-39827), server deadlock (CVE-2026-39830), RSA/DSA DoS (CVE-2026-39829), infinite loop (CVE-2026-39834), panics (CVE-2026-46597, CVE-2026-46598, CVE-2026-39835), and key constraint bypasses (CVE-2026-39831, CVE-2026-39832, CVE-2026-39833). A fully remediated version (v0.52.0) is available and should be targeted instead. Additionally, golang.org/x/sys v0.41.0 retains CVE-2026-39824 (integer overflow in NewNTUnicodeString on Windows), which is fixed in v0.45.0. The clean code analysis does not mitigate these dependency-level risks, as the two analyses are independent. Action items: (1) Run 'go get golang.org/x/crypto@v0.52.0' to resolve all 13 crypto advisories. (2) Run 'go get golang.org/x/sys@v0.45.0' to resolve the integer overflow CVE. These steps will significantly reduce the attack surface before merging.

Required Dependency Mitigations

• CRITICAL: golang.org/x/crypto upgraded to v0.46.0 but this version still has 13 active advisories including auth bypasses (CVE-2026-39828, CVE-2026-42508, CVE-2026-46595), DoS via memory leaks (CVE-2026-39827), server deadlock (CVE-2026-39830), RSA/DSA DoS (CVE-2026-39829), infinite loop (CVE-2026-39834), panics (CVE-2026-46597, CVE-2026-46598, CVE-2026-39835), key constraint bypasses (CVE-2026-39831, CVE-2026-39832, CVE-2026-39833). Dependency path: github.com/in-toto/in-toto-golang → golang.org/x/crypto. Run: go get golang.org/x/crypto@v0.52.0 to resolve all advisories.
• MODERATE: golang.org/x/sys upgraded to v0.41.0 but CVE-2026-39824 (integer overflow in NewNTUnicodeString on Windows, windows-only) persists in both old and new versions. The fix is available at v0.45.0. Dependency paths include: github.com/in-toto/in-toto-golang → golang.org/x/sys and github.com/yannh/kubeconform → github.com/hashicorp/go-retryablehttp → golang.org/x/sys. Run: go get golang.org/x/sys@v0.45.0

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: e4a811c, performed at: 2026-06-08T06:03:43Z