Why: govulncheck reported 20 module-level advisories against golang.org/x/crypto v0.37.0 (19 with upstream fixes, GO-2026-5932 unfixed); none were reachable from our code, but the whole batch clears with one routine bump — follow-up to the 2026-09-30 dependency CVE inventory.
Evidence: golang.org/x/crypto v0.37.0 => v0.56.0 (x/text follows to v0.41.0 as a requirement); CGO_ENABLED=0 go build ./... and go test -count=1 ./... green against the new core types; govulncheck now reports 0 affected, 0 import-level, 1 module-level (the upstream-unfixed GO-2026-5932 — the floor until upstream ships a fix).
Impact: go.mod/go.sum bumps only; no code change; x/crypto is not imported by any of our packages (transitive require).
Refs: Dev-side task fix/followup-hardening (gitlink pin follows after combined verification)
weichen