chore(deps): Bump golang.org/x/crypto from 0.29.0 to 0.31.0

[orgads]

Backport of #16297.

Fixes CVE-2024-45337. See golang/go#70779.

(cherry picked from commit 36553ae)

• No AI generated code was used in this PR

[telegraf-tiger]

Warning: this pull request is targeting a branch other than master (release-1.33)

[telegraf-tiger]

Download PR build artifacts for linux_amd64.tar.gz, darwin_arm64.tar.gz, and windows_amd64.zip.
Downloads for additional architectures and packages are available below.

🥳 This pull request decreases the Telegraf binary size by -1.76 % for linux amd64 (new size: 268.8 MB, nightly size 273.6 MB)

📦 Click here to get additional PR build artifacts

Artifact URLs

DEB	RPM	TAR GZ	ZIP
amd64.deb	aarch64.rpm	darwin_amd64.tar.gz	windows_amd64.zip
arm64.deb	armel.rpm	darwin_arm64.tar.gz	windows_arm64.zip
armel.deb	armv6hl.rpm	freebsd_amd64.tar.gz	windows_i386.zip
armhf.deb	i386.rpm	freebsd_armv7.tar.gz
i386.deb	ppc64le.rpm	freebsd_i386.tar.gz
mips.deb	riscv64.rpm	linux_amd64.tar.gz
mipsel.deb	s390x.rpm	linux_arm64.tar.gz
ppc64el.deb	x86_64.rpm	linux_armel.tar.gz
riscv64.deb		linux_armhf.tar.gz
s390x.deb		linux_i386.tar.gz
		linux_mips.tar.gz
		linux_mipsel.tar.gz
		linux_ppc64le.tar.gz
		linux_riscv64.tar.gz
		linux_s390x.tar.gz

[jdstrand]

@orgads - thanks for the PR! I'll let the telegraf team comment further, but I'll say that this issue doesn't affect telegraf because the issue deals with golang.org/x/crypto/ssh when operating as an SSH server, which telegraf does not do (telegraf only operates as an SSH client). Furthermore, while telegraf does indirectly import some server functions, it does not import (indirectly or otherwise) the affected PublicKeyCallback API.

As you referenced, #16297 was merged to fix this (and therefore it is queued for the upcoming 1.33.1 release). Since this issue doesn't affect telegraf, IMO we don't need to do an out-of-cycle emergency update in prior versions. cc @srebhan and @DStrand1

[orgads]

I'm not familiar with how you manage the branches. Isn't 1.33.1 released from release-1.33 branch?

[DStrand1]

I'm not familiar with how you manage the branches. Isn't 1.33.1 released from release-1.33 branch?

We release from the master branch, so all new PRs go there. We got this dependency bumped in #16297. Thanks for the PR effort though!

[orgads]

No problem, thank you.