govulncheck: drop the unmaintained x/crypto/openpgp dependency (GO-2026-5932)

[leggetter]

After the dependency and toolchain updates in #330, govulncheck reports exactly one remaining finding, and it is the only one with no upstream fix.

Vulnerability #1: GO-2026-5932
    The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design,
    and has known security issues
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.52.0
    Fixed in: N/A
    Example traces found:
      #1: pkg/version/version.go:10:2: version.init calls github.init, which eventually calls armor.init
      #4: pkg/version/version.go:10:2: version.init calls github.init, which calls openpgp.init

Fixed in: N/A — no version of x/crypto resolves it. The package has to stop being linked in.

Where it comes from

A single import, pulled in transitively:

pkg/version/version.go → github.com/google/go-github/v28/github → x/crypto/openpgp

It is reached through package init(), not through anything we call.

The fix looks small

go-github/v28 is pinned at v28.1.1. The current major is v90, and its go.mod requires only:

require (
	github.com/google/go-cmp v0.7.0
	github.com/google/go-querystring v1.2.0
)

No x/crypto. Upgrading drops the dependency entirely.

The surface we use is one function:

func getLatestVersion() string {
	client := github.NewClient(nil)
	rep, _, err := client.Repositories.GetLatestRelease(context.Background(), "hookdeck", "hookdeck-cli")
	...
	return *rep.TagName
}

Repositories.GetLatestRelease has been stable across majors, so the migration is likely an import-path change plus whatever go mod tidy settles.

Alternatives

• Upgrade go-github v28 → v90. Preferred; also clears 60-odd majors of drift on a dependency used for one call.
• Drop the dependency. A single unauthenticated GET /repos/hookdeck/hookdeck-cli/releases/latest would remove ~all of it. Worth considering given it's one call whose failure is already swallowed and logged at debug.

Priority

Low. It is an advisory about an unmaintained package rather than an exploitable path here — nothing calls into openpgp, it is merely linked. But it is the last remaining govulncheck finding, and clearing it means a clean scan, which makes future regressions obvious.

Context

Surfaced while clearing the Dependabot backlog for v2.4.0 (#330). Not a Dependabot alert, so it was out of scope there.