CVE-2024-45337: Trivy reports Critical vulnerability in current version of mint

I ran “trivy image --severity=CRITICAL --no-progress --exit-code 1 $(IMAGE)” on an image where I’d installed docker-slim (SLIM_VERSION=1.40.11). It triggered this failure.

usr/local/bin/mint (gobinary)

Total: 1 (CRITICAL: 1)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                         Title                          │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2024-45337 │ CRITICAL │ fixed  │ v0.29.0           │ 0.31.0        │ golang.org/x/crypto/ssh: Misuse of                     │
│                     │                │          │        │                   │               │ ServerConfig.PublicKeyCallback may cause authorization │
│                     │                │          │        │                   │               │ bypass in golang.org/x/crypto                          │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-45337             │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────┘

Start by reproducing the reported trivy image --severity=CRITICAL --no-progress --exit-code 1 $(IMAGE) scan against an image containing /usr/local/bin/mint from docker-slim 1.40.11. Trace the Go dependency or build configuration that supplies golang.org/x/crypto v0.29.0, update it to a version containing the CVE-2024-45337 fix, and confirm Trivy no longer reports the critical vulnerability.