Possible fix(deps): golang.org/x/crypto v0.54.0 → 0.55.0 (CVE-2026-56854) in go.mod

Spotted what might be an issue in `go.mod` around line 1.

CRITICAL vulnerability (CVE-2026-56854) in golang.org/x/crypto v0.54.0 (ssh package). The server-side enforcement of the source-address critical option in ssh.Permissions was incomplete: restrictions returned by PublicKeyCallback and VerifiedPublicKeyCallback were enforced, but the same restriction set by PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks was silently ignored, leaving the extension of the CVE-2026-46595 fix incomplete. Impact: any SSH server that restricts client access by IP (Permissions.CriticalOptions["source-address"]) and relies on password, keyboard-interactive, none, or GSSAPI-with-MIC authentication can be accessed from unauthorized hosts/networks. This is an authentication/authorization bypass — an attacker from any IP can authenticate and obtain a session despite an IP allowlist, potentially gaining full remote access to the system. Risk level: CRITICAL, because it defeats a documented access-control mechanism in the SSH server. Remediation: upgrade to golang.org/x/crypto v0.55.0, where the source-address check is applied to Permissions returned by every authentication callback.

Something like this might fix it:

````diff
Update the dependency in go.mod and refresh go.sum:

```diff
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
module example.com/your-app

require (
- golang.org/x/crypto v0.54.0
+ golang.org/x/crypto v0.55.0
)
```

Then run:

```bash
go get golang.org/x/crypto@v0.55.0
go mod tidy
go build ./...
```

Interim mitigation (if the upgrade cannot be applied immediately): do not rely on Permissions.CriticalOptions["source-address"] for the affected auth paths — validate the client's remote address explicitly inside each callback (e.g., compare conn.RemoteAddr() against your allowlist and return an error to reject the login), or temporarily disable PasswordCallback / KeyboardInteractiveCallback / NoClientAuthCallback / GSSAPI auth on the affected servers.
````

For reference: rule `CVE-2026-56854`. Rated critical.

If I have misread how this is used, sorry for the noise — feel free to close.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*