[Cycode] Fix for vulnerable manifest file dependency - golang.org/x/crypto updated to version 0.52.0

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
go.mod	1

📂 go.mod

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
golang.org/x/crypto	0.41.0	0.52.0

---

Note

Medium Risk
Touches a crypto library used for password hashing; risk is moderate due to dependency churn, but scope is limited to a version bump with no logic changes.

Overview
Bumps the direct golang.org/x/crypto dependency in go.mod from 0.41.0 to 0.52.0 to address reported vulnerabilities (Cycode manifest scan). There are no application code changes in this PR.

That module is used in-repo for bcrypt password hashing and comparison (internal/api/crypto/hash.go), so the upgrade is security-relevant even though behavior should stay the same aside from patched crypto implementations.

^{Reviewed by Cursor Bugbot for commit e05173f. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e05173f. Configure here.}

[cursor]

Missing go.sum crypto entries

High Severity

The direct require for golang.org/x/crypto is raised to v0.52.0, but root go.sum still only records checksums for v0.41.0. That leaves the module graph out of sync, so go mod verify and builds that enforce recorded sums can fail until go.sum is updated.

 

^{Reviewed by Cursor Bugbot for commit e05173f. Configure here.}

[cursor]

Crypto bump needs Go 1.25

Medium Severity

golang.org/x/crypto v0.52.0 declares go 1.25.0, while this module still specifies go 1.24.0 and toolchain go1.24.2. On toolchains with GOTOOLCHAIN=local, go mod tidy and builds can fail until the Go/toolchain version is raised or auto toolchain is allowed.

 

^{Reviewed by Cursor Bugbot for commit e05173f. Configure here.}