[clubanderson]

Summary

govulncheck (known vulnerabilities) is red on main, holding every PR with base-branch-red. All four findings are in golang.org/x/net@v0.59.0:

• GO-2026-6617
• GO-2026-6612
• GO-2026-6611
• GO-2026-6603

Bump golang.org/x/net v0.59.0 → v0.62.0 (pulls golang.org/x/sys v0.48.0 → v0.49.0) and go mod tidy. Same fix hive applied in hive#14731 / #14753.

Verification

• go build ./... clean
• govulncheck ./... → No vulnerabilities found.

Fixes #26

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

@clubanderson is auto-promoted for contributor-lane merging on this PR: the last 5 merged PRs by this author in this hive's repositories have no revert or sentinel-alert evidence. CI, reviewer verdict, diff fences, soak, holds and branch protection still apply.

[hivecommons-hive]

029daf6

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head 029daf6bb75d) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • go.mod

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[clubanderson]

Closing: crux's guard check refuses Go edits here because src/crux in hivecommons/hive is the source of truth. The bump is open as hivecommons/hive#14782 (base v5) and will be published here by the crux sync once it merges. Tracking stays on #26.

[hivecommons-hive]

@clubanderson this PR is held at stage/071-needs-author and the hive will not merge it yet.

Failing checks:

• check-failure

Next: the hive does not push to your branch. Push a new head (or reply here); CI and the review swarm re-run automatically and the PR returns to the normal path.