chore(deps): bump golang.org/x/crypto to v0.52.0 (#605)

## Summary

Remediates the open CRITICAL Dependabot alert for `golang.org/x/crypto`
by bumping it from `v0.45.0` to `v0.52.0` (patched version).

`golang.org/x/crypto v0.52.0` requires Go >= 1.25, so this also bumps
the module `go` directive `1.24.0 → 1.25.0` (and drops the now-redundant
`toolchain go1.24.1` line). CI resolves its Go version from `go.mod`
(`go-version-file: go.mod`); there are no Dockerfile pinned Go versions
to update.

```
golang.org/x/crypto v0.45.0 -> v0.52.0  (fixes CRITICAL alert)
go 1.24.0 -> 1.25.0 (required by x/crypto v0.52.0)
```

Transitive `golang.org/x/{net,sys,text,term}` were pulled forward by `go
mod tidy` as a consequence. The `vendor/` tree was regenerated via `go
mod vendor` — hence the large (mechanical) vendored diff.

### CI lint compatibility (`ci:` commit)

The Go 1.25 bump broke the CI `go-tests` job: the pinned `golangci-lint
v1.64.4` (built with Go 1.24) refuses to target a `go 1.25.0` module.
Upgraded the lint step to `golangci-lint-action@v8.0.0` + `golangci-lint
v2.5.0` (built with Go 1.25) and migrated `.golangci.yml` to the v2
schema (via `golangci-lint migrate`).

To preserve the *prior effective* linter behavior (and avoid
reformatting unrelated source), the v2-only linters that would otherwise
fire on existing code are disabled (`funcorder`, `godoclint`,
`noinlineerr`, `wsl_v5`), and staticcheck is configured to exclude the
`ST1*`/`QF1*` check groups (v1 had `stylecheck` disabled). The old
`goimports` `local-prefixes` setting was dropped because the v1 config
used the misspelled key `linter-settings`, so it was silently ignored
and never enforced.

Verified locally: `go build ./...`, `go vet ./...`, `go test ./...`, and
`golangci-lint run ./...` (v2.5.0) all pass. CI green.


Link to Devin session:
https://app.devin.ai/sessions/77c5bbaf5b114aac80ad2c021c2b14f4
Requested by: @kparkinson-ld

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Author: kparkinson-ld

.github/workflows/main.yml

@@ -25,9 +25,9 @@ jobs:
           go install gotest.tools/gotestsum@latest
 
       - name: Install golangci-lint
-        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
+        uses: golangci/golangci-lint-action@25e2cdc5eb1d7a04fdc45ff538f1a00e960ae128 # v8.0.0
         with:
-          version: v1.64.4
+          version: v2.5.0
 
       - name: Run tests with gotestsum
         run: |

.golangci.yml

@@ -1,64 +1,74 @@
-project_name: ld-find-code-refs
-
+version: "2"
 run:
-  deadline: 120s
   tests: false
-
 linters:
-  enable-all: true
+  default: all
   disable:
-      - golint
-      - stylecheck
-      - gochecknoglobals
-      - lll
-      - errcheck
-      - interfacer
-      - tagliatelle
-      - varnamelen
-      - nonamedreturns
-      - nlreturn # re-enable this after fixing all cases
-      - gomnd # re-enable this after fixing all cases
-      - nosnakecase
-      - ifshort # re-enable
-      - nilerr #re-enable
-      - goerr113
-      - exhaustivestruct
-      - exhaustruct
-      - exhaustive
-      - godot
-      - wsl #fix
-      - gocognit
-      - revive
-      - errname
-      - cyclop
-      - gofumpt # fix
-      - gci
-      - nestif # fix
-      - gosec
-      - gocritic
-      - depguard
-      - tagalign
-      - nilnil
-  fast: false
-
-linter-settings:
-  goimports:
-    local-prefixes: github.com/launchdarkly,gopkg.in/launchdarkly
-
+    - cyclop
+    - depguard
+    - err113
+    - errcheck
+    - errname
+    - exhaustive
+    - exhaustruct
+    - funcorder
+    - gochecknoglobals
+    - gocognit
+    - gocritic
+    - godoclint
+    - godot
+    - gosec
+    - lll
+    - mnd
+    - nestif
+    - nilerr
+    - nilnil
+    - nlreturn
+    - noinlineerr
+    - nonamedreturns
+    - revive
+    - tagalign
+    - tagliatelle
+    - varnamelen
+    - wsl
+    - wsl_v5
+  settings:
+    staticcheck:
+      checks:
+        - all
+        - -ST1*
+        - -QF1*
+  exclusions:
+    generated: lax
+    rules:
+      - linters:
+          - staticcheck
+        text: SA5011
+      - path: (.+)\.go$
+        text: error returned from external package is unwrapped
+      - path: (.+)\.go$
+        text: error returned from interface method should be wrapped
+      - path: (.+)\.go$
+        text: comparing with == will fail on wrapped errors. Use errors.Is to check for a specific error
+      - path: (.+)\.go$
+        text: comparing with != will fail on wrapped errors. Use errors.Is to check for a specific error
+      - path: (.+)\.go$
+        text: non-wrapping format verb for fmt.Errorf. Use `%w` to format errors
+      - path: (.+)\.go$
+        text: append to slice `projectKeys` with non-zero initialized length
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 issues:
-  exclude:
-    - "error returned from external package is unwrapped"
-    - "error returned from interface method should be wrapped"
-    - "comparing with == will fail on wrapped errors. Use errors.Is to check for a specific error" # should fix
-    - "comparing with != will fail on wrapped errors. Use errors.Is to check for a specific error" # should fix
-    - "non-wrapping format verb for fmt.Errorf. Use `%w` to format errors" # should fix
-    - "append to slice `projectKeys` with non-zero initialized length"
-  exclude-rules:
-    # Exclude some `staticcheck` messages.
-    - linters:
-        - staticcheck
-      text: "SA5011" # fix
-
-  exclude-use-default: false
   max-same-issues: 1000
-  max-per-linter: 1000
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

go.mod

@@ -1,8 +1,6 @@
 module github.com/launchdarkly/ld-find-code-refs/v2
 
-go 1.24.0
-
-toolchain go1.24.1
+go 1.25.0
 
 require (
 	github.com/bmatcuk/doublestar/v4 v4.9.1
@@ -66,11 +64,11 @@ require (
 	github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.45.0 // indirect
-	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/net v0.54.0 // indirect
 	golang.org/x/oauth2 v0.27.0 // indirect
-	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -262,8 +262,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -323,8 +323,8 @@ golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
+golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -374,19 +374,19 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
-golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=