[kycheng]

Closes CVE-2026-56855 / CVE-2026-78662 (golang.org/x/crypto v0.55.0 -> v0.56.0) and CVE-2026-84304 (google.golang.org/grpc v1.82.1 -> v1.83.1), scanned with the 2026-09-07 trivy DB. go mod tidy pulled the transitive go-spiffe / otel-contrib bumps.

GO-2026-5932 (x/crypto) has no upstream fix and remains.

Test plan: go build ./cmd/... ./pkg/... (GOEXPERIMENT=jsonv2) passes, go mod tidy clean, trivy rescan of go.mod shows only the no-fix advisory.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WiJtA4jxhaQsff6f7wsjqR

[kycheng]

Note on the two integration jobs, which are hanging rather than failing:

Integration Test and Module Integration Test sit at

Downloading ghcr.io/aquasecurity/trivy-test-images:spring4shell-jre11...

and print nothing further until the job is cancelled. Every other job in the same run (Test, Build Test, E2E, K8s Integration, VM Integration) passes.

This is not caused by this PR. I dispatched the same workflow on the unmodified base branch alauda-v0.68.2 (run 34162011255): it hangs at the identical point, same cache key (cache-test-images-634040a4..., cache miss in both cases), 40 minutes with no output, while all its other jobs pass. For comparison, the same fixture list downloaded in ~4s per image and the job finished in 12 minutes on 2026-09-03.

Mechanism: magefiles/fixture.go pulls the fixtures with crane.Pull, and go-containerregistry has no client timeout, so a stalled ghcr.io transfer hangs the job until the 6h limit instead of failing.

Things already ruled out:

• the fixture list (identical cache key to the last green run)
• the Go version (go/toolchain in go.mod untouched by this PR)
• anonymous ghcr rate limiting: I tried setting GITHUB_TOKEN on the fixture-downloading steps (the crane keychain picks it up); the log confirms the token was applied and the job still hung at the same image. That experimental commit has been removed again, so this PR is back to the dependency bump alone.

So this looks like an ghcr.io / runner-egress problem on the day rather than anything in the tree. Suggested handling: re-run the two jobs when ghcr recovers, or merge on the strength of the other checks - the change itself is go.mod/go.sum only (x/crypto v0.55.0 -> v0.56.0, grpc v1.82.1 -> v1.83.1), verified locally with go build ./cmd/... ./pkg/... under GOEXPERIMENT=jsonv2.

🤖 Generated with Claude Code