Summary

Remediates the open CRITICAL Dependabot alert for golang.org/x/crypto by bumping it from v0.45.0 to v0.52.0 (patched version).

golang.org/x/crypto v0.52.0 requires Go >= 1.25, so this also bumps the module go directive 1.24.0 → 1.25.0 (and drops the now-redundant toolchain go1.24.1 line). CI resolves its Go version from go.mod (go-version-file: go.mod); there are no Dockerfile pinned Go versions to update.

golang.org/x/crypto v0.45.0 -> v0.52.0  (fixes CRITICAL alert)
go 1.24.0 -> 1.25.0 (required by x/crypto v0.52.0)

Transitive golang.org/x/{net,sys,text,term} were pulled forward by go mod tidy as a consequence. The vendor/ tree was regenerated via go mod vendor — hence the large (mechanical) vendored diff.

CI lint compatibility (ci: commit)

The Go 1.25 bump broke the CI go-tests job: the pinned golangci-lint v1.64.4 (built with Go 1.24) refuses to target a go 1.25.0 module. Upgraded the lint step to golangci-lint-action@v8.0.0 + golangci-lint v2.5.0 (built with Go 1.25) and migrated .golangci.yml to the v2 schema (via golangci-lint migrate).

To preserve the prior effective linter behavior (and avoid reformatting unrelated source), the v2-only linters that would otherwise fire on existing code are disabled (funcorder, godoclint, noinlineerr, wsl_v5), and staticcheck is configured to exclude the ST1*/QF1* check groups (v1 had stylecheck disabled). The old goimports local-prefixes setting was dropped because the v1 config used the misspelled key linter-settings, so it was silently ignored and never enforced.

Verified locally: go build ./..., go vet ./..., go test ./..., and golangci-lint run ./... (v2.5.0) all pass. CI green.

Link to Devin session: https://app.devin.ai/sessions/77c5bbaf5b114aac80ad2c021c2b14f4
Requested by: @kparkinson-ld