x/crypto: transitive dependency package "golang.org/x/net" is not updated with latest crypto version

[Supriya-Khedkar87]

latest version of crypto package is still using same version of below transitive decency -
golang.org/x/net v0.21.0 // tagx:ignore

Are we going to update transitive decencies with parent component?

[dmitshur]

The golang.org/x/crypto module only uses the golang.org/x/net/idna package from the golang.org/x/net module, and that package hasn't changed since v0.21.0: https://go.googlesource.com/net/+diff/v0.21.0..v0.39.0/idna. So there aren't any changes to pull in.

That said, the automated monthly tagging workflow can do better at upgrading these, even if not to the very latest (upcoming) version, but at least to the one before. I filed #73264 for that.

Closing since there's nothing to do here.