Bump golang.org/x/net and golang.org/x/crypto to fix known CVEs

[pujitha24]

Motivation:
A vulnerability scan flagged two indirect dependencies pulled in via
github.com/prometheus/exporter-toolkit/web and
github.com/prometheus/common/config:

• golang.org/x/net v0.55.0 (CVE-2026-46600, fixed in v0.56.0)
• golang.org/x/crypto v0.52.0 (CVE-2026-56854, fixed in v0.55.0)

Approach:
Ran go get golang.org/x/net@v0.57.0 golang.org/x/crypto@v0.55.0
followed by go mod tidy. x/net had to go to v0.57.0 rather than the
minimum v0.56.0 because golang.org/x/crypto@v0.55.0's own go.mod
requires golang.org/x/net@v0.57.0 (confirmed via go mod graph); this
is Go's minimal version selection, not a manual choice. go mod tidy
also bumped the transitively-required golang.org/x/sync, golang.org/x/sys,
and golang.org/x/text to versions compatible with the new x/net/x/crypto.
No source files were touched; both packages are only reachable
transitively, pushgateway's own code never imports them directly.

A newer golang.org/x/crypto v0.56.0 is available and additionally fixes
three golang.org/x/crypto/ssh advisories, but bumping to it also raises
this module's go.mod go directive from 1.25.0 to 1.26.0, which is a
larger, unrelated change. pushgateway does not import the ssh package
(govulncheck confirms 0 reachable vulnerabilities either way), so this
change stays at v0.55.0 to keep the fix minimal and scoped to the two
reported CVEs.

Validation:

• go build ./... succeeds.
• go test ./... passes (api/v1, handler, storage).
• go mod tidy produces no further diff (go.mod/go.sum are tidy).
• golangci-lint run reports 0 issues (run with a local golangci-lint
  v2.13.2 build; the repo's own make lint target auto-downloads the
  pinned v2.12.2 binary, which is built with go1.26 and panics against
  this machine's go1.27.1 toolchain - a local environment mismatch,
  not something this change causes. Upstream CI runs inside the
  quay.io/prometheus/golang-builder:1.26-base container, so this
  mismatch will not occur there).
• govulncheck reports "Your code is affected by 0 vulnerabilities"
  both before and after this change, since neither package is called
  directly; the bump removes the flagged modules from the dependency
  list regardless.

Report: #868
Signed-off-by: Pujitha Paladugu 10557236+pujitha24@users.noreply.github.com
Assisted-by: claude-sonnet-5 (via Claude Code)

Fixes #868

[rogov-sa]

Lgtm

[jan--f]

According to govulncheck the two CVE mentioned here are not reachable in this code here. However it reports other vulnerabilities for the same modules, so we should update those. Mind rebasing this please?

[pujitha24]

Makes sense, thanks for checking reachability. The branch was already on top of current master (fcc512b), so there was nothing to rebase. I added one commit bumping x/crypto to v0.57.0, which covers the two other x/crypto findings govulncheck showed at v0.55.0 (GO-2026-6354, GO-2026-6355). go mod tidy pulled x/net to v0.58.0, x/sys, x/text and x/sync forward as well, and moved the go directive from 1.25.0 to 1.26.0 because x/crypto v0.57 requires it. The CI builder image is already golang-builder:1.26, but say if you'd rather not raise the directive. go build, go vet and go test ./... pass locally; govulncheck now reports only GO-2026-5932 (x/crypto, no fixed version, not called from this code).

[jan--f]

@pujitha24 The PR reports a conflict though

[pujitha24]

You're right, master had moved on since I checked. I rebased onto 41fd8c1. Master had already picked up x/crypto v0.56.0 and x/net v0.58.0 via the dependabot bumps, so my first commit became empty and dropped out, and the PR is now a single commit moving x/crypto to v0.57.0 (plus x/sync, x/sys and x/text from go mod tidy). The go directive is already 1.26.0 on master, so that change is gone too. go build ./..., go vet ./... and go test ./... pass on the rebased branch; I couldn't rerun govulncheck here, so I haven't re-verified the remaining-findings claim against v0.57.0. The branch needs a force-push to update.

[jan--f]

Thanks!
Please read https://prometheus.io/docs/guides/contributing/#ai-generated-contributions.