Update golang.org/x/crypto

[Starttoaster]

Part of #807

[Starttoaster]

I saw that you actually have #751 open. My update goes a bit past yours, noting the screenshot from my linked Issue where golang.org/x/crypto is actually vulnerable through 0.31.0. (CVEs are actually fairly consistently found in the crypto lib, so I'm sure even updating to 0.31.0, there would be another CVE to take its place.)

But after seeing your PR I wondered if there's any point to mine. It would be useful to better understand what your strategy is on accepting changes, since yours hasn't been accepted yet. If it's just a free time thing, I can understand that. I'd actually looked to see if you were part of the GitHub partner program, because I'd have liked to help support you in developing this utility if you had set that up.

[sosedoff]

I have very little time for this project these days so i just try to address the most pressing issues when i have a chance.
For this particular PR, i don't think its going to be needed as i've closed mine and also opened up another one #820 to bump the package version even further.

Main issues with such upgrades is that even if CI reports green, there might be some side effects, like issues with SSH connectivity, and others. So generally speaking, there's a bunch of manual testing required before merging a change like this.

[Starttoaster]

That's completely understandable, thanks for your reply. I own a handful of public (and even more private) Golang projects myself and am in a similar situation. Though I tend to just take in dependency updates anyway, and don't usually find them to be breaking changes. None of my utilities I support establish SSH connections though, so I'm less familiar with the breaking changes there. And the utilities I support are mostly simpler than pgweb in scope.

Thanks for pgweb! It's a very nice looking Postgres web UI compared to the more popular alternatives out there. And it was much simpler to deploy. I try to stay on top of my k8s CVEs, which is... mostly a folly trying to keep up with them. But I may just own a more simplified down fork of pgweb that just does what I need it to do (which doesn't include SSH, and a few other things pgweb does), that's a bit less scary to have dependabot keep updated, haha. Anyway, cheers to someday having tons of free time in retirement 😂