Update golang.org/x/crypto

[wxiaoguang]

ref: https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg, CVE-2023-48795, https://go.dev/issue/64784

[laf0rge]

will there also be a back-port of this security release to the 1.20.x version?

[wxiaoguang]

1.20 has been unmaintained for long time, and maybe there is not only just this one security problem (I am sure ...)

So, please upgrade.

[divialth]

1.20 has been unmaintained for long time, and maybe there is not only just this one security problem (I am sure ...)

for me the same question just popped up, if there will be a back-port.
I just checked it, the last commit to the 1.20 branch was last week. Because of this I think this version is still maintained or I am complete wrong?

[techknowlogick]

@laf0rge @divialth we are working on our LTS versioning plans, but as of now our standard EOL policy applies where once a new major stable version is out then generally we stop support for the older version. For 1.20 there was one version that was released that was after this date, but for most commits to it are just documentation changes for clarification for users on old versions.
As @wxiaoguang said though, it is strongly recommended to switch to 1.21, bit just for the many bug fixes, but also several security fixes too