From f58f1172bd6a2217c148d7c4773c9a44c028c98f Mon Sep 17 00:00:00 2001
From: rq-jwhitlock <jwhitlock@reliaquest.com>
Date: Tue, 8 Sep 2026 09:01:51 -0600
Subject: [PATCH] fix(envconsul): GO-2026-6303, GO-2026-6354, GO-2026-6355
 0.14.0-r6

Bump golang.org/x/crypto to v0.56.0 to remediate three x/crypto/ssh
advisories. Also moves golang.org/x/text to v0.41.0, which x/crypto
v0.56.0 requires (still >= v0.39.0, so GO-2026-5970 stays remediated).
---
 envconsul.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/envconsul.yaml b/envconsul.yaml
index 97496bd51fc..0b15c5d32ad 100644
--- a/envconsul.yaml
+++ b/envconsul.yaml
@@ -1,7 +1,7 @@
 package:
   name: envconsul
   version: "0.14.0"
-  epoch: 5 # toolchain rebuild for  go-1.27-1.27.1
+  epoch: 6 # GO-2026-6303, GO-2026-6354, GO-2026-6355
   description: "Launch a subprocess with environment variables using data from @hashicorp Consul and Vault."
   copyright:
     - license: MPL-2.0
@@ -30,7 +30,9 @@ pipeline:
 
   - uses: bump
     with:
-      deps: golang.org/x/text@v0.39.0
+      deps: |-
+        golang.org/x/crypto@v0.56.0
+        golang.org/x/text@v0.41.0
 
   - uses: go/build
     with: