Bump golang.org/x/crypto v0.45.0 to address CVEs on crypto v0.36.0

[dtma007]

What would you like to be added?

These 2 CVEs are reported on versions of golang.org/x/crypto before 0.45.0

• CVE-2025-47914
• CVE-2025-58181

Could we get a released version of etcd with golang.org/x/crypto 0.45.0 ? (I noticed main branch already has it:https://github.com/etcd-io/etcd/blob/main/go.mod#L99 , but the released versions will have crypto 0.36.0)

Thanks.

Why is this needed?

To address security vulnerabilities:

• CVE-2025-47914
• CVE-2025-58181

[ivanvc]

Hi @dtma007, thanks for opening this issue. According to our documentation we don't bump dependencies for our stable branches. We only do a release if the severity is >= 7.5

etcd/Documentation/contributor-guide/release.md

Lines 43 to 47 in 584c7cc

	## Patch release criteria
	The etcd project aims to release a new patch version if any of the following conditions are met:
	- Fixed one or more major CVEs (>=7.5).

That being said, I don't oppose to bump the dependencies before our next release. What do you think, @ahrtr?

[ahrtr]

It should be fine to bump for both main and stable releases.