fix: remediate Dependabot vulnerabilities

[devin-ai-integration]

Summary

Remediates all 21 open Dependabot alerts, which fall across two (indirect) dependencies. Both are transitive; upgrading pulls in the patched versions and updates the vendored tree via go mod tidy + go mod vendor.

• golang.org/x/crypto v0.45.0 -> v0.52.0 — resolves 16 alerts (7 CRITICAL, 2 HIGH, 7 MODERATE) in the SSH stack (auth bypasses, DoS/panics, cert restriction bypass, key-constraint enforcement).
• github.com/go-git/go-git/v5 v5.16.2 -> v5.19.1 — resolves 5 alerts (1 HIGH, 3 MODERATE, 1 LOW): object-parsing inconsistency, credential leak via cross-host redirect, .git dir modification, idx/pack integrity + memory issues, SSH single-quote escaping.

Transitive bumps carried in by the above: pjbgf/sha1cd 0.3.2->0.6.0, golang.org/x/sys 0.38.0->0.45.0, golang.org/x/text 0.31.0->0.37.0, plus new indirect klauspost/cpuid/v2. The go directive moves 1.24.0 -> 1.25.0 as required by the upgraded go-git; CI provisions Go from go.mod (go-version-file: go.mod) so this is picked up automatically.

No application code changed. go build ./..., go test ./..., and the golangci-lint pre-commit hook all pass locally.

Resolved advisories

• x/crypto: GHSA-rm3j-f69w-wqmq, GHSA-x527-x647-q7gg, GHSA-89gr-r52h-f8rx, GHSA-5cgq-3rg8-m6cv, GHSA-f5wc-c3c7-36mc, GHSA-vgwf-h737-ff37, GHSA-jppx-rxg9-jmrx (CRITICAL); GHSA-w879-237q-wc7r, GHSA-q4h4-gmj2-qvw2 (HIGH); GHSA-45gg-vh54-h5m9, GHSA-9m57-25v3-79x9, GHSA-78mq-xcr3-xm33, GHSA-qpw4-5x99-6vjp (MODERATE)
• go-git: GHSA-389r-gv7p-r3rp (HIGH); GHSA-3xc5-wrhm-f963, GHSA-jhf3-xxhw-2wpp, GHSA-crhj-59gh-8x96, GHSA-w5pp-99ch-qj29, GHSA-37cx-329c-33x3 (MODERATE); GHSA-gm2x-2g9h-ccm8, GHSA-m7cr-m3pv-hgrp (LOW)

Link to Devin session: https://app.devin.ai/sessions/5c26e15ad7154257a668a4d28481c70c
Requested by: @pkaeding

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[pkaeding]

the test failure is "Unknown project key demo-dan-042021-2" -- is that expected?

[devin-ai-integration]

the test failure is "Unknown project key demo-dan-042021-2" -- is that expected?

Yes — that failure is preexisting and unrelated to this PR. The e2e-tests job runs the action against the live LaunchDarkly project demo-dan-042021-2, which no longer exists, so the LD API returns 404 Unknown project key. It fails identically on every recent PR and on main (the earlier x/crypto bump branch and the dependabot-cooldown branch hit the same 404); the last green e2e runs were June GitHub-Actions dependabot PRs, before the project was deleted.

Nothing in this diff touches that — it's purely a go.mod/go.sum/vendor dependency bump. The real test suite (go-test), generate-docs, and the security scan all pass. Fixing e2e requires restoring/repointing that test project key in the workflow, which is out of scope for this remediation.