Update dependencies

[attiasas]

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

Summary by CodeRabbit

• Updates
  • Updated the bundled Analyzer Manager fallback version to 1.56.0.
  • Updated several underlying components and security-related libraries to newer versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 4abdb00e-b4de-4d23-b346-c62160993152

📥 Commits

Reviewing files that changed from the base of the PR and between 628d34c and 564b4c4.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• go.mod
• jas/analyzermanager.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates direct and indirect Go dependencies. It also changes the fallback Analyzer Manager version from 1.55.0 to 1.56.0.

Changes

Dependency and Analyzer Manager Updates

Layer / File(s)	Summary
Version updates go.mod, jas/analyzermanager.go	Direct and indirect dependency versions were updated in go.mod. The default Analyzer Manager version changed to 1.56.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: eranturgeman

Merge Risk: ⚪ Minimal · up to 564b4

The changes update dependency versions and the fallback Analyzer Manager release path without evidence of a current failure.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main dependency updates. It is concise and relevant to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📗 Scan Summary

• Frogbot scanned for vulnerabilities and found 3 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	3 Issues Found 3 High
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	Not Found
Secrets	✅ Done	Not Found
Services	ℹ️ Not Scanned	-
Infrastructure as Code (IaC)	✅ Done	Not Found

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Dependency Path
High	CVE-2026-78662	Not Applicable	1 Direct golang.org/x/crypto:0.53.0 1 Transitive golang.org/x/crypto:0.53.0
High	CVE-2026-56855	Not Applicable	1 Direct golang.org/x/crypto:0.53.0 1 Transitive golang.org/x/crypto:0.53.0
High	CVE-2026-56854	Not Applicable	1 Direct golang.org/x/crypto:0.53.0 1 Transitive golang.org/x/crypto:0.53.0

🔖 Details

[ CVE-2026-78662 ] golang.org/x/crypto 0.53.0

Vulnerability Details

Contextual Analysis:	Not Applicable
CVSS V3:	7.5
Dependency Path:	golang.org/x/crypto: 0.53.0 (Transitive)

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.

Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

[ CVE-2026-56855 ] golang.org/x/crypto 0.53.0

Vulnerability Details

Contextual Analysis:	Not Applicable
CVSS V3:	7.5
Dependency Path:	golang.org/x/crypto: 0.53.0 (Transitive)

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.

Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

[ CVE-2026-56854 ] golang.org/x/crypto 0.53.0

Vulnerability Details

Contextual Analysis:	Not Applicable
CVSS V3:	7.5
Dependency Path:	golang.org/x/crypto: 0.53.0 (Transitive)

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.

---

🐸 JFrog Frogbot