[hivecommons-hive]

v6 still pins golang.org/x/net v0.61.0, so the required govulncheck check is red on every PR against v6 (GO-2026-6860 via connector.richHTMLToMarkdown → html.ParseFragment), including the forward-merge #14724 that would otherwise carry fixes over. #14731 fixed v5 but no v6 PR touches go.mod, so this cherry-picks that squash onto v6 (go.mod/go.sum/NOTICE/changelog only; the oauth2 go.sum lines v6 carries are kept).

Refs #14726 (incident already closed for v5; this is the v6 half).

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v6

Conflicts are checked with every PR merged onto the current tip of v6, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

Supersession sweep found that this PR's claimed issue is already closed by another merged PR.

• Claimed issue: hive#14726
• Closing PR: #14731

Closing this hive-authored PR because the claimed issue was already closed by the merged PR below.

This comment is edited in place by the supersession sweep; it is not duplicated.