fix(deps): update module golang.org/x/crypto to v0.46.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/crypto	v0.45.0 -> v0.46.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
golang.org/x/sync	v0.18.0 -> v0.19.0
golang.org/x/sys	v0.38.0 -> v0.39.0
golang.org/x/text	v0.31.0 -> v0.32.0

[claude]

PR Review: Update golang.org/x/crypto to v0.46.0

Summary

This is a dependency update PR generated by Renovate that updates golang.org/x/crypto from v0.45.0 to v0.46.0, along with transitive dependency updates for golang.org/x/sync, golang.org/x/sys, and golang.org/x/text.

Code Quality ✅

• Clean dependency update: The changes are limited to go.mod and go.sum files only
• No code changes required: This is a minor version update that maintains backward compatibility
• Follows semantic versioning: The v0.x series indicates pre-1.0 API, but golang.org/x packages are generally stable

Security Considerations 🔒

Important findings:

1. SSH implementation usage (fs/sftp/sftp.go:11)

   • The codebase uses golang.org/x/crypto/ssh for SFTP connections
   • CRITICAL SECURITY ISSUE IDENTIFIED (fs/sftp/sftp.go:33-35): The SSH host key callback currently accepts ANY host key without validation:

     HostKeyCallback: func(hostname string, remote net.Addr, key ssh.PublicKey) error {
         return nil
     },

   • This makes the connection vulnerable to MITM attacks
   • While this PR doesn't introduce this issue, keeping crypto dependencies up-to-date is crucial for this security-sensitive code

2. Password hashing (config/config.go:17)

   • Uses github.com/go-crypt/crypt/algorithm/bcrypt for password hashing
   • This is indirect usage, but crypto updates can affect underlying primitives

3. Benefits of this update:

   • Security patches and bug fixes in the crypto library
   • Keeping dependencies current reduces technical debt
   • golang.org/x/crypto updates often include fixes for CVEs

Performance Considerations ⚡

• Minimal impact: Dependency updates typically have negligible performance impact
• Potential improvements: Crypto library updates sometimes include performance optimizations
• Transitive updates: The bump in golang.org/x/sync (v0.18.0 → v0.19.0) may include concurrency improvements

Test Coverage 📋

Concerns:

• Per CLAUDE.md, the project has limited test coverage (only fs/utils/env_test.go)
• Recommendation: While this PR should be safe, consider adding integration tests for SFTP and authentication flows to catch any behavioral changes in future crypto library updates
• The CI checks should verify that existing tests still pass

Potential Issues ⚠️

None identified for this PR specifically, but:

• Automerge is enabled - ensure CI passes before merging
• Breaking changes in v0.46.0 are unlikely but should be monitored
• The transitive dependency updates (x/sys, x/text, x/sync) are also minor versions

Recommendations 📝

1. ✅ Approve and merge this PR once CI passes - keeping crypto dependencies current is a security best practice

2. ⚠️ Address the SFTP host key validation issue separately:

   • The HostKeyCallback in fs/sftp/sftp.go should validate host keys properly
   • Consider implementing known_hosts file support or certificate pinning
   • This is a separate security concern unrelated to this PR

3. Consider adding tests for crypto-sensitive code paths:

   • SFTP connection establishment
   • Password hashing/verification
   • Any TLS/SSL configurations

4. Monitor the changelog for golang.org/x/crypto v0.46.0 to understand what improvements are included

Conclusion

LGTM ✅ - This is a routine dependency update that improves security posture. The changes follow best practices for Go dependency management, and automerge is appropriate for this type of update once CI validates the changes.

---

🤖 Review generated with assistance from Claude Code