fix(deps): vuln minor upgrades — 5 packages (minor: 5) [apps/pass-api/go.mod]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 5 packages upgraded (MINOR changes included)

Manifests changed:

• apps/pass-api/go.mod (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
golang.org/x/crypto	v0.28.0	v0.55.0	minor	Transitive	24 CRITICAL, 10 HIGH, 18 MEDIUM, 2 UNKNOWN
golang.org/x/net	v0.30.0	v0.58.0	minor	Transitive	2 CRITICAL, 4 HIGH, 17 MEDIUM, 2 UNKNOWN
golang.org/x/mod	v0.21.0	v0.40.0	minor	Transitive	2 UNKNOWN
golang.org/x/sys	v0.26.0	v0.47.0	minor	Transitive	1 UNKNOWN
golang.org/x/text	v0.19.0	v0.41.0	minor	Transitive	1 UNKNOWN

---

Security Details

🚨 Critical & High Severity (40 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
golang.org/x/crypto	GO-2024-3321	critical	Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto	v0.28.0	0.31.0	-
golang.org/x/crypto	GHSA-v778-237x-gjrc	CRITICAL	Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto	v0.28.0	0.31.0	-
golang.org/x/crypto	CVE-2024-45337	critical	Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto	v0.28.0	-	-
golang.org/x/crypto	GHSA-jppx-rxg9-jmrx	CRITICAL	golang.org/x/crypto doesn't enforce invoking key constraints	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39833	CRITICAL	Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent	v0.28.0	-	-
golang.org/x/crypto	GO-2026-5005	CRITICAL	Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent	v0.28.0	0.52.0	-
golang.org/x/crypto	GHSA-89gr-r52h-f8rx	CRITICAL	golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39831	CRITICAL	Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh	v0.28.0	-	-
golang.org/x/crypto	GO-2026-5019	CRITICAL	Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh	v0.28.0	0.52.0	-
golang.org/x/crypto	GO-2026-5023	CRITICAL	Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2026-46595	CRITICAL	Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh	v0.28.0	-	-
golang.org/x/crypto	GHSA-x527-x647-q7gg	CRITICAL	golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement	v0.28.0	0.52.0	-
golang.org/x/crypto	GO-2026-5021	CRITICAL	Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2026-42508	CRITICAL	Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts	v0.28.0	-	-
golang.org/x/crypto	GO-2026-5006	critical	Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39832	critical	Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent	v0.28.0	-	-
golang.org/x/crypto	GHSA-f5wc-c3c7-36mc	CRITICAL	golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys	v0.28.0	0.52.0	-
golang.org/x/crypto	GO-2026-5017	critical	Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39830	critical	Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh	v0.28.0	-	-
golang.org/x/crypto	GHSA-vgwf-h737-ff37	CRITICAL	golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses	v0.28.0	0.52.0	-
golang.org/x/crypto	GHSA-5cgq-3rg8-m6cv	CRITICAL	golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39834	CRITICAL	Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh	v0.28.0	-	-
golang.org/x/crypto	GO-2026-5020	CRITICAL	Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh	v0.28.0	0.52.0	-
golang.org/x/crypto	GHSA-rm3j-f69w-wqmq	CRITICAL	golang.org/x/crypto vulnerable to infinite loop on large channel writes	v0.28.0	0.52.0	-
golang.org/x/net	CVE-2026-39821	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.30.0	-	-
golang.org/x/net	GO-2026-5026	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.30.0	0.55.0	-
golang.org/x/crypto	GHSA-56w8-48fp-6mgv	HIGH	golang.org/x/crypto/ssh/agent has a potential denial of service	v0.28.0	-	-
golang.org/x/crypto	CVE-2026-39829	high	Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh	v0.28.0	-	-
golang.org/x/crypto	GO-2026-5018	high	Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh	v0.28.0	0.52.0	-
golang.org/x/crypto	GHSA-w879-237q-wc7r	HIGH	golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS	v0.28.0	0.52.0	-
golang.org/x/crypto	GO-2025-4116	HIGH	Potential denial of service in golang.org/x/crypto/ssh/agent	v0.28.0	0.43.0	-
golang.org/x/crypto	GHSA-q4h4-gmj2-qvw2	HIGH	golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2026-46597	HIGH	Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh	v0.28.0	-	-
golang.org/x/crypto	GO-2026-5013	HIGH	Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh	v0.28.0	0.52.0	-
golang.org/x/crypto	GHSA-hcg3-q754-cr77	HIGH	golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange	v0.28.0	0.35.0	-
golang.org/x/crypto	GO-2025-3487	HIGH	Potential denial of service in golang.org/x/crypto	v0.28.0	0.35.0	-
golang.org/x/net	GO-2026-4918	high	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.30.0	0.53.0	-
golang.org/x/net	GHSA-w32m-9786-jp63	HIGH	Non-linear parsing of case-insensitive content in golang.org/x/net/html	v0.30.0	-	-
golang.org/x/net	GO-2024-3333	HIGH	Non-linear parsing of case-insensitive content in golang.org/x/net/html	v0.30.0	0.33.0	-
golang.org/x/net	CVE-2026-33814	high	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.30.0	-	-

ℹ️ Other Vulnerabilities (43)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
golang.org/x/crypto	GO-2026-5016	medium	Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39827	medium	Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh	v0.28.0	-	-
golang.org/x/crypto	GO-2025-4135	medium	Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent	v0.28.0	0.45.0	-
golang.org/x/crypto	CVE-2025-47914	medium	Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent	v0.28.0	-	-
golang.org/x/crypto	GO-2026-5015	medium	Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39835	medium	Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh	v0.28.0	-	-
golang.org/x/net	GO-2026-5027	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.30.0	0.55.0	-
golang.org/x/net	CVE-2026-42506	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.30.0	-	-
golang.org/x/net	GO-2026-5025	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.30.0	0.55.0	-
golang.org/x/net	GO-2026-5029	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.30.0	0.55.0	-
golang.org/x/net	CVE-2026-27136	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.30.0	-	-
golang.org/x/net	GO-2026-5030	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.30.0	0.55.0	-
golang.org/x/net	CVE-2026-42502	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.30.0	-	-
golang.org/x/net	CVE-2026-25680	medium	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.30.0	-	-
golang.org/x/net	GO-2026-5028	medium	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.30.0	0.55.0	-
golang.org/x/net	CVE-2026-25681	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.30.0	-	-
golang.org/x/crypto	GHSA-9m57-25v3-79x9	MODERATE	golang.org/x/crypto: Invoking pathological inputs can lead to client panic	v0.28.0	0.52.0	-
golang.org/x/crypto	GHSA-f6x5-jh6r-wrfv	MODERATE	golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read	v0.28.0	0.45.0	-
golang.org/x/crypto	CVE-2026-46598	MODERATE	Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent	v0.28.0	-	-
golang.org/x/crypto	CVE-2026-39828	MODERATE	Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh	v0.28.0	-	-
golang.org/x/crypto	GO-2026-5014	MODERATE	Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh	v0.28.0	0.52.0	-
golang.org/x/crypto	CVE-2025-58181	MODERATE	Unbounded memory consumption in golang.org/x/crypto/ssh	v0.28.0	-	-
golang.org/x/crypto	GO-2025-4134	MODERATE	Unbounded memory consumption in golang.org/x/crypto/ssh	v0.28.0	0.45.0	-
golang.org/x/crypto	GHSA-j5w8-q4qc-rx2x	MODERATE	golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption	v0.28.0	0.45.0	-
golang.org/x/crypto	GO-2026-5033	MODERATE	Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent	v0.28.0	0.52.0	-
golang.org/x/crypto	GHSA-78mq-xcr3-xm33	MODERATE	golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow	v0.28.0	0.52.0	-
golang.org/x/crypto	GHSA-45gg-vh54-h5m9	MODERATE	golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions	v0.28.0	0.52.0	-
golang.org/x/crypto	GHSA-qpw4-5x99-6vjp	MODERATE	golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS	v0.28.0	0.52.0	-
golang.org/x/net	GHSA-vvgc-356p-c3xw	MODERATE	golang.org/x/net vulnerable to Cross-site Scripting	v0.30.0	0.38.0	-
golang.org/x/net	GO-2025-3595	MODERATE	Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net	v0.30.0	0.38.0	-
golang.org/x/net	GHSA-5cv4-jp36-h3mw	MODERATE	Go Net HTML parser is vulnerable to denial of service	v0.30.0	0.55.0	-
golang.org/x/net	GO-2026-4440	MODERATE	Quadratic parsing complexity in golang.org/x/net/html	v0.30.0	0.45.0	-
golang.org/x/net	GHSA-w4gw-w5jq-g9jh	MODERATE	golang.org/x/net/html has a Quadratic Parsing Complexity issue	v0.30.0	-	-
golang.org/x/net	GO-2025-3503	MODERATE	HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net	v0.30.0	0.36.0	-
golang.org/x/net	GHSA-qxp5-gwg8-xv66	MODERATE	HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net	v0.30.0	0.36.0	-
golang.org/x/crypto	GO-2026-5932	unknown	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	v0.28.0	-	-
golang.org/x/crypto	GO-2026-6303	unknown	Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh	v0.28.0	0.55.0	-
golang.org/x/mod	GO-2026-6180	unknown	Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb	v0.21.0	0.40.0	-
golang.org/x/mod	GO-2026-6179	unknown	Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog	v0.21.0	0.40.0	-
golang.org/x/net	GO-2026-4441	unknown	Infinite parsing loop in golang.org/x/net	v0.30.0	0.45.0	-
golang.org/x/net	GO-2026-5942	unknown	Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage	v0.30.0	0.56.0	-
golang.org/x/sys	GO-2026-5024	unknown	Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows	v0.26.0	0.44.0	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.19.0	0.39.0	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System