chore(deps): fix vulnerabilities reported by govulncheck

[github-actions]

Vulnerability Report

golang.org/x/net → v0.55.0

GO-2026-5025 (CVE-2026-42506)

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

References

• https://go.dev/issue/79571
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781700

GO-2026-5026 (CVE-2026-39821)

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

References

• https://go.dev/cl/767220
• https://go.dev/issue/78760
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8

GO-2026-5027 (CVE-2026-42502)

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

References

• https://go.dev/issue/79572
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781701

GO-2026-5028 (CVE-2026-25680)

Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

References

• https://go.dev/cl/781702
• https://go.dev/issue/79573
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8

GO-2026-5029 (CVE-2026-25681)

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

References

• https://go.dev/issue/79574
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781703

GO-2026-5030 (CVE-2026-27136)

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

References

• https://go.dev/issue/79575
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781685

golang.org/x/sys → v0.44.0

GO-2026-5024 (CVE-2026-39824)

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

References

• https://go.dev/issue/78916
• https://go.dev/cl/770080
• https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg

stdlib → v1.25.11

GO-2026-5037 (CVE-2026-27145)

Inefficient candidate hostname parsing in crypto/x509

References

• https://go.dev/cl/783621
• https://go.dev/issue/79694
• https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw

GO-2026-5038 (CVE-2026-42504)

Quadratic complexity in WordDecoder.DecodeHeader in mime

References

• https://go.dev/issue/79217
• https://go.dev/cl/774481
• https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw

GO-2026-5039 (CVE-2026-42507)

Arbitrary inputs are included in errors without any escaping in net/textproto

References

• https://go.dev/issue/79346
• https://go.dev/cl/777060
• https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw