fix: bump vulnerable dependencies (CVE scanner)

[humoflife]

CVE Fix

This PR was automatically generated by the Upbound Marketplace CVE Scanner.

It bumps vulnerable Go dependencies to the minimum safe version identified by the OSV vulnerability database.

Vulnerabilities addressed

Severity	Package	From	To	Advisory	Description
✅ medium	golang.org/x/net	v0.33.0	v0.36.0	GHSA-qxp5-gwg8-xv66	HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
✅ medium	golang.org/x/net	v0.33.0	v0.38.0	GHSA-vvgc-356p-c3xw	golang.org/x/net vulnerable to Cross-site Scripting
✅ medium	golang.org/x/net	v0.33.0	v0.36.0	GO-2025-3503	HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
✅ medium	golang.org/x/net	v0.33.0	v0.38.0	GO-2025-3595	Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
✅ medium	golang.org/x/net	v0.33.0	v0.45.0	GO-2026-4440	Quadratic parsing complexity in golang.org/x/net/html
✅ medium	golang.org/x/net	v0.33.0	v0.45.0	GO-2026-4441	Infinite parsing loop in golang.org/x/net
✅ high	golang.org/x/oauth2	v0.22.0	v0.27.0	GHSA-6v2p-p543-phr9	golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
✅ medium	golang.org/x/oauth2	v0.22.0	v0.27.0	GO-2025-3488	Unexpected memory consumption during token parsing in golang.org/x/oauth2
✅ critical	google.golang.org/grpc	v1.67.0	v1.79.3	GHSA-p77j-4mvh-x3m3	gRPC-Go has an authorization bypass via missing leading slash in :path
✅ medium	google.golang.org/grpc	v1.67.0	v1.79.3	GO-2026-4762	Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

Verification

✅ Post-fix rescan confirmed all addressed vulnerabilities are resolved in the updated go.mod.

Checklist

• CI passes
• go mod tidy has been applied (included in this PR)
• No unintended API-breaking version bumps

[jbw976]

Thanks for this update @humoflife!

Can you please sign the DCO also?

[jbw976]

i think there were a bunch of go stdlib vulnerabilities fixed in go v1.25.9, e.g.:

• https://pkg.go.dev/vuln/GO-2026-4947
• https://pkg.go.dev/vuln/GO-2026-4946
• https://pkg.go.dev/vuln/GO-2026-4870
• https://pkg.go.dev/vuln/GO-2026-4869
• etc.

Did the scans you ran find those too?

[humoflife]

Hi @jbw976 — good catch! The original CVE scanner only scanned Go module dependencies against the OSV database; it did not audit the Go standard library, so those stdlib vulnerabilities were missed.

I ran govulncheck ./... (with the freshly rebuilt tool against the current Go version) and confirmed the following stdlib CVEs do affect this project (reachable call chains exist):

ID	Package	Description	Fixed in
GO-2026-4947	crypto/x509	Unexpected work during chain building	go1.26.2 / go1.25.9
GO-2026-4946	crypto/x509	Inefficient policy validation	go1.26.2 / go1.25.9
GO-2026-4870	crypto/tls	Unauthenticated TLS 1.3 KeyUpdate DoS	go1.26.2 / go1.25.9
GO-2026-4866	crypto/x509	Case-sensitive excludedSubtrees auth bypass	go1.26.2 / go1.25.9
GO-2026-4865	html/template	JsBraceDepth XSS	go1.26.2 / go1.25.9

Two more stdlib CVEs are present in the dependency graph but have no reachable call chain from this module:

ID	Package	Description
GO-2026-4869	archive/tar	Unbounded allocation for old GNU sparse
GO-2026-4864	os (Linux)	TOCTOU root escape via Root.Chmod

Fix applied in this PR: bumped the toolchain directive from go1.24.4 → go1.26.2. A follow-up govulncheck ./... returns no vulnerabilities found.