<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA — resolves high-severity code-scanning alerts in
`tools/`
Bumps the outdated `golang.org/x/net` and `golang.org/x/crypto` indirect
dependencies in the four `tools/` Go modules to clear 39 high-severity
code-scanning (SCA) alerts on `main`. Target versions match the root
Fleet
module.
| Module | x/net | x/crypto |
| --- | --- | --- |
| `tools/dibble` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** |
| `tools/hangar` | v0.53.0 → **v0.55.0** | v0.50.0 → **v0.52.0** |
| `tools/terraform` | v0.48.0 → **v0.55.0** | v0.46.0 → **v0.52.0** |
| `tools/github-manage` | v0.38.0 → **v0.55.0** | — |
CVEs cleared:
- **x/net v0.55.0**: CVE-2026-25681, -27136, -33814, -39821, -42502
- **x/crypto v0.52.0**: CVE-2026-39827, -39828, -39829, -39830, -39832,
-39835, -42508, -46595, -46597
All four modules `go mod verify` clean and build. Dependency-only change
to
internal dev tooling — no product code, no user-visible behavior.
> The remaining 8 high-severity alerts in `tools/` are OpenSSF Scorecard
> "Binary-Artifacts" findings for embedded dibble seed installers; those
are
> tracked separately and not addressed here.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated several bundled Go dependencies across internal tooling to
newer versions.
* This includes refreshes to common networking, cryptography, text, and
system packages, plus one added telemetry-related dependency.
* No user-facing features or behavior changes were introduced.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Luke Heath