Take x/crypto v0.56.0, raise the floor to Go 1.26, pin CI to 1.27.1

[packetloss404]

Closes the last red CI job. vulncheck reported seven reachable advisories, all in golang.org/x/crypto v0.43.0 and all reached through internal/computers/ssh_backend.go.

Why 1.26 and not 1.25

The advisories split across two fix versions:

advisories	fixed in	x/crypto's own go directive
GO-2026-5013, 5017, 5018, 5019, 5020	x/crypto v0.52.0	go 1.25.0
GO-2026-6354, GO-2026-6355	x/crypto v0.56.0	go 1.26.0

The v0.52.0 route looks like the cautious middle ground and is not:

• 1.25 is already end of life. Go supports the two most recent majors, and the current release is 1.27.1. That means 1.27 and 1.26 are supported; 1.25 is not, and the existing 1.24.2 floor is two releases past EOL. A 1.25 floor would move to an unsupported language version.
• It leaves CI red. GO-2026-6354 and 6355 are "DoS on deadlocked undecided/established channel in golang.org/x/crypto/ssh". Both are called, so vulncheck keeps failing and two live DoS paths stay open through the SSH backend.

Raising the floor is the cost either way, so it should buy the whole fix rather than five sevenths of it.

What the floor actually costs

Less than it looks:

• CI and the release pipeline already build with a 1.26 toolchain, so nothing in this project's own pipeline changes.
• go.mod has no toolchain line, so under the default GOTOOLCHAIN=auto a contributor on an older Go fetches a compliant toolchain automatically instead of hitting a build error.
• The builds that genuinely have to move are those pinned to GOTOOLCHAIN=local — chiefly distro packaging and air-gapped builds.

x/sys (v0.38.0 → v0.47.0) and x/text (v0.30.0 → v0.41.0) come along as transitive upgrades. The bump was done with go get rather than by applying docs/audit/patches/P10b-x-crypto-v0.56.0-go1.26.patch, because that patch was generated against an older go.mod and would have carried a stale go.sum. The result matches its intent.

Second commit: CI pin to 1.27.1

Separate and independently revertable. The remaining govulncheck findings are all standard library and the highest is fixed in go1.26.6, so the existing 1.26.8 pin already covered them — but 1.27.1 is the current release, and pinning the newer of the two supported majors needs the least maintenance. Disclosure: I chose 1.26.8 earlier while looking only within the 1.26 line; 1.27 was current the whole time.

Verification

Run on windows/amd64 against the branch tip:

check	result
govulncheck ./... (v1.3.0, the version CI pins)	no reachable module advisories
golangci-lint run --max-issues-per-linter=0 --max-same-issues=0 ./... under GOOS=linux, darwin, windows	0 findings each
go build ./... for all three GOOS	exit 0
go vet ./...	exit 0
go test -count=1 ./...	exit 0, 55 packages

The ten advisories govulncheck still reports locally are all standard library, and they appear only because this machine's toolchain is go1.26.2:

fixed in	count
go1.26.3	2
go1.26.4	2
go1.26.5	1
go1.26.6	5

The highest is go1.26.6, and CI now pins 1.27.1, so the job should be clean. That split is itself a useful confirmation: the stdlib set is governed by the toolchain pin, the module set by this dependency bump, and after this change the module set is empty.

Two stale premises, deliberately not rewritten

Both are dated decision records rather than live instructions, so I left them alone rather than editing history — but each rests partly on a fact this PR changes:

• BACKLOG.md:89 — the 2026-08-14 decision to reject charm.land/catwalk cites "declares go 1.26.6 against this repo's 1.24.2" as one of five reasons. That objection is now gone. The other four (prometheus and protobuf pulled in for 70 lines of stdlib HTTP, no mistral entry, MiniMax-M3 priced at the wrong tier, no tiered-pricing field) still stand, so the decision holds.
• docs/research/upstream-adoption-plan.md:439 — argues against an import because "importing it forces a Go bump on every contributor and CI runner". That cost is now already paid.

docs/audit/security-audit-2026-09-05.md also states the old floor. It is a dated audit record and is left as written.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T18:36:29.197781Z	872e276	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 872e276f89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the offline manual's Go prerequisite

Updating only the Markdown manuals leaves the user-facing offline manual inconsistent: README.md links docs/packetcode-manual.html as the offline HTML5 manual, but its install section at line 420 still says Go 1.24.2 is supported. Users following that copy with GOTOOLCHAIN=local or without toolchain-download access will fail immediately because go.mod now requires 1.26.0, so the HTML manual should be updated alongside this line.

Useful? React with 👍 / 👎.