Critical vulnerability detected in a dependency

[jakub-m-sobczak]

Describe the Bug
A critical vuln in golang.org/x/crypto detected by Grype:

NAME                          INSTALLED  FIXED-IN  TYPE       VULNERABILITY        SEVERITY
github.com/golang-jwt/jwt/v4  v4.4.2     4.5.1     go-module  GHSA-29wx-vh33-7x7r  Low
golang.org/x/crypto           v0.27.0    0.31.0    go-module  GHSA-v778-237x-gjrc  Critical
libcrypto3                    3.1.7-r0   3.1.7-r1  apk        CVE-2024-9143        Medium
libssl3                       3.1.7-r0   3.1.7-r1  apk        CVE-2024-9143        Medium

Vuln:
CVE-2024-45337

Migrate Version
v4.18.1

Go Version
1.22

Additional context
This can be fixed with a PR by bumping golang.org/x/crypto from 0.27.0 to 0.31.0: #1210

[joschi]

The respective functionality (SSH server in golang.org/x/crypto/ssh) affected by CVE-2024-45337 is not used by migrate at all, I think this is not really critical in context of this project.

Updating the dependency would be nice, but it's not a game changer.

[jakub-m-sobczak]

Thanks @joschi. You're right. However, for some, not updating the dependency may be a little uncomfortable, bc Criticals have this annoying tendency to stop builds 😃