[appleboy]

Summary

The daily Trivy Security Scan workflow on the default branch has been failing because golang.org/x/crypto v0.54.0 is affected by CVE-2026-56854 (CRITICAL, golang.org/x/crypto/ssh).

• Bump golang.org/x/crypto to v0.55.0 in every go.mod of this repository (including example modules).
• go mod tidy refreshed the transitive golang.org/x/* versions that v0.55.0 requires. Only go.mod / go.sum files changed.

Related issues

• Jira: N/A
• GitHub: N/A (fixes the failing scheduled Trivy Security Scan workflow)

AI authorship

• No AI was used
• AI was used
  • Tool / model: Claude Code (Claude Fable 5.1)
  • AI-authored files: all go.mod / go.sum files in this PR (generated with go get + go mod tidy)
  • Human line-by-line reviewed: None — not yet reviewed by a human.

Change classification

• Leaf change
• Core change

Dependency-only bump; no source code changed.

Plan reference

Goal: make the Trivy Security Scan workflow pass on the default branch by upgrading the vulnerable dependencies to their fixed versions. Scope: go.mod / go.sum only.

Verification

• Automated:
  • trivy fs --scanners vuln,secret,misconfig --severity CRITICAL,HIGH,MEDIUM --ignore-unfixed --exit-code 1 . (same flags as CI, vulnerability DB dated 2026-09-05): pass, 0 findings
  • go build ./... in every module: pass
  • go test ./... in the root module: pass for unit tests
• Manual: none
• Not run: tests that require external services (Redis / memcached / MongoDB) were not run locally; they are covered by CI.

Security check

• No secrets in the diff
• External inputs are validated
• Permission checks are tested
• Errors do not leak internals
• N/A - no external or security-sensitive interface changed

Risk and rollback

• Risk: minimal; minor-version bumps of Go standard extension packages with no API changes used by this repo.
• Rollback: revert this commit.

Reviewer guide

• Read carefully: nothing beyond the version numbers in go.mod.
• Spot-check: go.sum hash updates are mechanical output of go mod tidy.

[Copilot]

🟢 Approval recommended

The changes are scoped to mechanical dependency/version updates across all modules and appear complete and consistent with the stated goal of resolving the Trivy finding.

Pull request overview

This PR updates golang.org/x/crypto to v0.55.0 (and the golang.org/x/text transitive requirement to v0.41.0) across the root module and all example modules to address a Trivy scan failure caused by a vulnerability in golang.org/x/crypto/ssh.

Changes:

• Bumped golang.org/x/crypto from v0.54.0 → v0.55.0 in all go.mod files in the repo.
• Updated corresponding go.sum entries (and refreshed golang.org/x/text from v0.40.0 → v0.41.0 as part of module tidying).

File summaries

File	Description
go.mod	Updates golang.org/x/crypto and golang.org/x/text indirect requirements in the root module.
go.sum	Updates module checksums corresponding to the bumped dependencies in the root module.
_example/example01/go.mod	Mirrors the dependency bump in example module 01.
_example/example01/go.sum	Updates checksums for the bumped dependencies in example module 01.
_example/example02/go.mod	Mirrors the dependency bump in example module 02.
_example/example02/go.sum	Updates checksums for the bumped dependencies in example module 02.
_example/example03/go.mod	Mirrors the dependency bump in example module 03.
_example/example03/go.sum	Updates checksums for the bumped dependencies in example module 03.
_example/example04/go.mod	Mirrors the dependency bump in example module 04.
_example/example04/go.sum	Updates checksums for the bumped dependencies in example module 04.

Review details

• Files reviewed: 5/10 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.