[clubanderson]

Summary

govulncheck (known vulnerabilities) is red on hivecommons/crux main, holding every crux PR with base-branch-red. crux's Go code is synced from src/crux/ here (crux's guard check refuses direct edits — see hivecommons/crux#27), so the bump lands on v5.

All four findings are in golang.org/x/net@v0.59.0 in src/crux/go.mod:

• GO-2026-6617
• GO-2026-6612
• GO-2026-6611
• GO-2026-6603

Bump golang.org/x/net v0.59.0 → v0.62.0 (pulls golang.org/x/sys v0.48.0 → v0.49.0), go mod tidy, and add a security changelog fragment. Same fix as #14731 / #14753 for the root module.

Verification

• cd src/crux && go build ./... clean
• cd src/crux && govulncheck ./... → No vulnerabilities found.

Fixes #14781
Fixes hivecommons/crux#26

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hanthor for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

@clubanderson is auto-promoted for contributor-lane merging on this PR: the last 5 merged PRs by this author in this hive's repositories have no revert or sentinel-alert evidence. CI, reviewer verdict, diff fences, soak, holds and branch protection still apply.

[hivecommons-hive]

Evidence bundle `#14782b436749` sha256:1f9cd9a2cc8c75f3ffc2d5ee28b8df409b83d24c03490d5f0699b62942459fea — download from the dashboard or `hivectl review evidence #14782`.

[hivecommons-hive]

merged by Hive trusted-author auto-merge: author @clubanderson holds role owner and GitHub permission admin on repo; CI green at b436749.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback