Remediate Dependabot alerts for x/crypto and jwt-go

[AnjriI]

Dependabot identified 14 vulnerabilities in direct dependencies declared in go.mod: 13 in golang.org/x/crypto and one in github.com/golang-jwt/jwt/v5.

These include authentication and authorization bypasses, unenforced SSH key and certificate restrictions, denial-of-service conditions, panics, deadlocks, and excessive memory allocation during JWT header parsing.

Although govulncheck found no currently reachable vulnerable symbols, upgrading removes the affected dependency versions and prevents vulnerable functionality from being used in the future.

Dependabot alerts addressed

• Critical: x/crypto alerts Fix provider-id according to CoHDI requirements #21, Added writing driver's SSH port to save it to secret #23, fix/3243: Misleading log when deregistering OS #26, Extend userdata with new method: ImplantRKE2Config; #27, Task/3141 exchange ssh keys via cloud-init #28, Upgrade Go Versioin to 1.24.7 - Task/3153 #30, and Task/3143 SUSE registration #31
• High: jwt/v5 alert Update changelog v0.1.7 #11 and x/crypto alerts update gpu models and unit tests; #22 and Task/3140 #24
• Moderate: x/crypto alerts Fix handling ssh issue during machine removal #25, Added fix for logging formatting #29, Upgrade golang.org/x/crypto to version 0.45.0 #32, and Stery/3139 extend userdata #33

The alerts cover:

• SSH authentication and certificate restriction bypasses
• SSH agent key-constraint enforcement issues
• FIDO/U2F physical-presence verification bypass
• Infinite loops, deadlocks, panics, and memory leaks that may cause denial of service
• Excessive memory allocation while parsing JWT headers

Changes

• Upgrade github.com/golang-jwt/jwt/v5 from v5.2.1 to v5.2.2.
• Upgrade golang.org/x/crypto from v0.45.0 to v0.52.0.
• Update the related golang.org/x/sys and golang.org/x/term dependencies.
• Update the Go toolchain and CI workflow to Go 1.25.12.
• Refresh dependency checksums in go.sum.

Validation

• go mod verify
• go test ./... on Linux
• CGO_ENABLED=0 go build
• govulncheck ./... — no reachable vulnerabilities found
• git diff --check

[fujitsu-domzalskis]

Hmm, did you try it on physical environment? Was the cluster provisioned properly?