[ai-collaboration-app]

Release artifact scans still report GO-2026-5932 for golang.org/x/crypto v0.58.0. Update the indirect requirement to v0.58.1-0.20261009181718-2f1f834330b2, the exact fixed revision listed in the Go vulnerability database. This upstream commit separates the unmaintained OpenPGP packages into their own module. The backup CLI imports only x/crypto/sha3; the retained module files are byte-for-byte identical to v0.58.0, and the dependency still requires Go 1.26.0. The repository remains on Go 1.26.10.

Reuse the already merged Renovate fixes #123 (Brotli 1.2.7, CVE-2026-111497) and #124 (compress 1.20.2, CVE-2026-116591). Their combined main CI passed all five release targets; downloaded security evidence has no Trivy vulnerability or secret findings and only GO-2026-5932 in Grype.

Related canonical ticket: https://github.com/StackVista/cve-reporter/issues/114 (supervisor owns delivery verification and ticket updates).
Scan provenance: https://github.com/StackVista/cve-reporter/actions/runs/42183453045, attempt 1, aggregate sha256:18a7dc3341e07a33facd41c5f3dac16aa01a4c5b0d792e72f111fa126fe8ff5d.

Validation passed at signed head 8062fe34b954f39e900dee21f658531c4d66644d:

• Local go mod verify, go test ./..., configured golangci-lint v2.15.0 (zero issues), build, and CLI help/version smoke checks passed. Local Grype found zero fixable vulnerabilities with the 2026-11-06 database.
• PR CI passed lint, tests, license scanning, GoReleaser configuration and full artifact security validation.
• Downloaded release-artifact-security evidence confirms Brotli 1.2.7, compress 1.20.2, fixed x/crypto and Go 1.26.10 in darwin amd64/arm64, Linux amd64/arm64 and Windows amd64. Trivy vulnerability findings: 0; Grype findings: 0; all-severity secret findings: 0. Govulncheck reported no vulnerabilities for source and all five binaries. Checksums, target architectures and symbol tables were verified by the existing artifact scripts. Vulnerability reporting remains informational.
• The architecture dependency audit found four existing cross-layer imports in unchanged main source (restore → portforward, scale, scripts; scale → restorelock); this dependency-only change adds none.

Ready for supervisor-assigned independent review.

After independent review and normal protected merge, publish the normal v0.11.3 release through the existing tag-triggered workflow. GitHub/S3 archive names remain consumable by container-tools STS_BACKUP_VERSION, STS_BACKUP_SHA256_AMD64, and STS_BACKUP_SHA256_ARM64; consumer adoption belongs to the supervisor. The full v0.11.2-to-main release range contains merged dependency (AWS, ClickHouse, Kubernetes and compression) and CI/Renovate updates, with no application-code changes. Publication has not occurred.