Upgrade golang.org/x/crypto from v0.38.0 to v0.48.0 to resolve
CVE-2025-47913 (GO-2025-4116), a denial-of-service vulnerability in
golang.org/x/crypto/ssh/agent where SSH clients receiving
SSH_AGENT_SUCCESS when expecting a typed response will panic and cause
early termination of the client process. The fix was introduced in
v0.43.0.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Will no longer provide full hostname with path from provided
`--hostname` flag for cloudflared access to the Host header field.
This addresses certain issues caught from a security fix in go
1.19.11 and 1.20.6 in the net/http URL parsing.
limkevin.chao
Devin Carr
Bas Westerbaan
cthuang
Sudarsan Reddy
Igor Postelnik
Adam Chalmers
Nick Vollmar
Michael Borkenstein
Areg Harutyunyan