Fix possible fix(deps): 5 vulnerable dependencies in go.mod

[begininvoke]

This changes go.mod to address something a scan flagged. It is around line 1.

The project depends on golang.org/x/net v0.54.0, which is vulnerable to CVE-2026-25681. This flaw allows parsing of arbitrary HTML that is later rendered, potentially creating an unexpected HTML tree and enabling cross‑site scripting (XSS) attacks. An attacker could inject malicious scripts, steal user data, or perform actions on behalf of victims. The vulnerability is rated HIGH, indicating a serious security risk for any application that renders user‑provided HTML.

Update vulnerable dependencies to patch known CVEs: upgrade golang.org/x/net to v0.56.0 and golang.org/x/text to v0.39.0.

For reference: rule CVE-2026-25681. Rated high.

I do not know the codebase, so please check the change fits how the rest of it works. Happy to adjust it or close this if the reasoning is off.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

---

Summary by cubic

Upgrades golang.org/x/net from v0.54.0 to v0.56.0 and golang.org/x/text from v0.37.0 to v0.39.0 to patch CVE-2026-25681 and remove an XSS risk in HTML parsing. Behavior note: no app code changes, but upstream parsing and normalization may differ; watch for regressions in HTML rendering or text handling.

^{Written for commit 0064c8c. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 1 file

Confidence score: 2/5

• go.mod upgrades golang.org/x/net and golang.org/x/text without matching checksums in go.sum, so builds using -mod=readonly can fail with missing go.sum entries; regenerate and commit go.sum for these versions.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="go.mod">

<violation number="1" location="go.mod:102">
P2: This upgrades both modules without their new checksums in `go.sum`; builds using `-mod=readonly` fail with missing go.sum entries. Regenerate and commit `go.sum` with these upgrades.</violation>

<violation number="2" location="go.mod:102">
P1: go.mod was bumped to golang.org/x/net v0.56.0 and golang.org/x/text v0.39.0, but go.sum was not updated to match. No hashes (h1 or /go.mod) for these versions exist in go.sum; the old v0.54.0/v0.37.0 entries remain. Because Go verifies modules against go.sum by default (-mod=readonly), go build fails with 'missing go.sum entry' until go.sum is regenerated. Run `go mod tidy` (or `go mod download`) and commit the resulting go.sum changes in the same PR.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P1: go.mod was bumped to golang.org/x/net v0.56.0 and golang.org/x/text v0.39.0, but go.sum was not updated to match. No hashes (h1 or /go.mod) for these versions exist in go.sum; the old v0.54.0/v0.37.0 entries remain. Because Go verifies modules against go.sum by default (-mod=readonly), go build fails with 'missing go.sum entry' until go.sum is regenerated. Run go mod tidy (or go mod download) and commit the resulting go.sum changes in the same PR.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At go.mod, line 102:

<comment>go.mod was bumped to golang.org/x/net v0.56.0 and golang.org/x/text v0.39.0, but go.sum was not updated to match. No hashes (h1 or /go.mod) for these versions exist in go.sum; the old v0.54.0/v0.37.0 entries remain. Because Go verifies modules against go.sum by default (-mod=readonly), go build fails with 'missing go.sum entry' until go.sum is regenerated. Run `go mod tidy` (or `go mod download`) and commit the resulting go.sum changes in the same PR.</comment>

<file context>
@@ -99,9 +99,9 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
-	golang.org/x/net v0.54.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
</file context>

[cubic-dev-ai]

P2: This upgrades both modules without their new checksums in go.sum; builds using -mod=readonly fail with missing go.sum entries. Regenerate and commit go.sum with these upgrades.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At go.mod, line 102:

<comment>This upgrades both modules without their new checksums in `go.sum`; builds using `-mod=readonly` fail with missing go.sum entries. Regenerate and commit `go.sum` with these upgrades.</comment>

<file context>
@@ -99,9 +99,9 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
-	golang.org/x/net v0.54.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
</file context>