deps: Upgrade 3 packages to remove 17 vulnerabilities

[BacklineAI]

🔐 Security Vulnerability Fixes

✅ This pull request was created and verified by Backline to fix security vulnerabilities in your dependencies.

---

📦 Package Updates & Vulnerability Fixes

golang.org/x/crypto

v0.0.0-20160922170629-8e06e8ddd962 → v0.46.0

• 🟥 CVE-2024-45337 - golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto.
• 🟧 CVE-2017-3204 - golang-googlecode-go-crypto: Go SSH library does not verify host keys by default.
• 🟧 CVE-2020-29652 - golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference.
• 🟧 CVE-2020-7919 - golang: Integer overflow on 32bit architectures via crafted certificate allows for denial of service.
• 🟧 CVE-2020-9283 - golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic.
• 🟧 CVE-2021-43565 - golang.org/x/crypto: empty plaintext packet causes panic.
• 🟧 CVE-2022-27191 - golang: crash in a golang.org/x/crypto/ssh server.
• 🟧 CVE-2025-22869 - golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh.
• 🟨 CVE-2019-11840 - golang.org/x/crypto: Keystream loop in amd64 assembly when overflowing 32-bit counter.
• 🟨 CVE-2019-11841 - A message-forgery issue was discovered in crypto/openpgp/clearsign/cle ...
• 🟨 CVE-2023-48795 - ssh: Prefix truncation attack on Binary Packet Protocol (BPP).
• 🟨 CVE-2025-47914 - golang.org/x/crypto/ssh/agent: in golang.org/x/crypto/ssh/agent.
• 🟨 CVE-2025-58181 - golang.org/x/crypto/ssh: in golang.org/x/crypto/ssh.

golang.org/x/sys

v0.0.0-20160916181909-8f0908ab3b24 → v0.39.0 (Recommended: <= 0.0.0-20220412211240-33da011f77ad)

• 🟨 CVE-2022-29526 - golang: syscall: faccessat checks wrong group.

gopkg.in/yaml.v2

v2.0.0-20160912165603-31c299268d30 → v2.2.8 (Recommended: <= 2.2.8)

• 🟧 CVE-2022-3064 - go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents.
• 🟨 CVE-2019-11254 - kubernetes: Denial of service in API server via crafted YAML payloads by authorized users.
• 🟨 CVE-2021-4235 - go-yaml: Denial of Service in go-yaml.

^{Legend: 🟥 Critical | 🟧 High | 🟨 Medium | 🟦 Low}

---

⚠️ Breaking Change Notice

** version upgrade to 1.24.0**
Please review the following before merging:

• 🔧 Local Development: Update your local installation to 1.24.0
• 🚀 CI/CD Pipeline: Verify build pipelines and Docker images use 1.24.0
• 📋 Dependencies: Ensure all build tools are compatible with the new version

---

Backline is here to help accelerate the remediation of your security backlog. Here's how we operate:

📥 Fetch Findings – Gather security issues
🔍 Analyze Findings – Understand the context and impact
📝 Plan Remediation – Generate a safe and effective fix strategy
👷 Apply Fix – Implement the remediation in code
🧪 Validate Code – Ensure the changes maintain code quality and integrity
✅ Verify – Run tests to ensure correctness and stability