Update dependency tox to v4.57.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
tox (changelog)	4.56.4 → 4.57.0

---

Release Notes

tox-dev/tox (tox)

v4.57.0

Compare Source

What's Changed

• 💰 Surface the org itself in the FUNDING config by @​webknjaz in #​3979
• Replace prettier with mdformat and yamlfmt by @​gaborbernat in #​3984
• 📦 build: use test dependency group in internal envs by @​gaborbernat in #​3985
• ✨ feat(python): match free-threaded and debug interpreter builds by @​chuenchen309 in #​3986

New Contributors

• @​chuenchen309 made their first contribution in #​3986

Full Changelog: tox-dev/tox@4.56.4...4.57.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Trivy Security Scan

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	v1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

workspace/pushgateway

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	github.com/prometheus/prometheus	v0.302.1	0.311.3	CVE-2026-42151	github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
🟠 HIGH	github.com/prometheus/prometheus	v0.302.1	0.311.3, 0.305.2	CVE-2026-42154	github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint
🟠 HIGH	golang.org/x/crypto	v0.35.0	0.43.0	CVE-2025-47913	golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS
🟠 HIGH	golang.org/x/crypto	v0.35.0	0.52.0	CVE-2026-39828	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
🟠 HIGH	golang.org/x/crypto	v0.35.0	0.52.0	CVE-2026-39829	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
🟠 HIGH	golang.org/x/crypto	v0.35.0	0.52.0	CVE-2026-39830	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
🟠 HIGH	golang.org/x/crypto	v0.35.0	0.52.0	CVE-2026-39831	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
🟠 HIGH	golang.org/x/crypto	v0.35.0	0.52.0	CVE-2026-39832	golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
🟠 HIGH	golang.org/x/crypto	v0.35.0	0.52.0	CVE-2026-39835	golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
🟠 HIGH	golang.org/x/crypto	v0.35.0	0.52.0	CVE-2026-42508	golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
🟠 HIGH	golang.org/x/crypto	v0.35.0	0.52.0	CVE-2026-46595	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
🟠 HIGH	golang.org/x/crypto	v0.35.0	0.52.0	CVE-2026-46597	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
🟠 HIGH	golang.org/x/net	v0.36.0	0.55.0	CVE-2026-25681	golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
🟠 HIGH	golang.org/x/net	v0.36.0	0.55.0	CVE-2026-27136	golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
🟠 HIGH	golang.org/x/net	v0.36.0	0.53.0	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	golang.org/x/net	v0.36.0	0.55.0	CVE-2026-39821	golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH	golang.org/x/oauth2	v0.25.0	0.27.0	CVE-2025-22868	golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws
🔴 CRITICAL	stdlib	v1.24.1	1.24.13, 1.25.7, 1.26.0-rc.3	CVE-2025-68121	crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
🟠 HIGH	stdlib	v1.24.1	1.24.4	CVE-2025-22874	crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509
🟠 HIGH	stdlib	v1.24.1	1.24.12, 1.25.6	CVE-2025-61726	golang: net/url: Memory exhaustion in query parameter parsing in net/url
🟠 HIGH	stdlib	v1.24.1	1.24.11, 1.25.5	CVE-2025-61729	crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate
🟠 HIGH	stdlib	v1.24.1	1.25.8, 1.26.1	CVE-2026-25679	net/url: Incorrect parsing of IPv6 host literals in net/url
🟠 HIGH	stdlib	v1.24.1	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	v1.24.1	1.25.9, 1.26.2	CVE-2026-32280	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
🟠 HIGH	stdlib	v1.24.1	1.25.9, 1.26.2	CVE-2026-32281	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
🟠 HIGH	stdlib	v1.24.1	1.25.9, 1.26.2	CVE-2026-32283	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	v1.24.1	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	os: golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22121: golang security update (IMPORTANT)
🟠 HIGH	stdlib	v1.24.1	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	v1.24.1	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header