diranged / oz / 38561538290

36%

push

github

chore(deps): update module golang.org/x/net to v0.55.0 [security] (#467)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.49.0` →
`v0.55.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.49.0...refs/tags/v0.55.0)
|
![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.55.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.49.0/v0.55.0?slim=true)
|

---

### Go Net HTML parser is vulnerable to denial of service
[CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) /
[GHSA-5cv4-jp36-h3mw](https://redirect.github.com/advisories/GHSA-5cv4-jp36-h3mw)

<details>
<summary>More information</summary>

#### Details
In Go Net (`golang.org/x/net`) before verion 0.55.0, parsing arbitrary
HTML can consume excessive CPU time, possibly leading to denial of
service.

#### Severity
- CVSS Score: 6.5 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680)
- [https://go.dev/cl/781702](https://go.dev/cl/781702)
- [https://go.dev/issue/79573](https://go.dev/issue/79573)
-
[https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8)
-
[https://pkg.go.dev/vuln/GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028)
-
[https://go.googlesource.com/net/+/<a class=hub.com/diranged/oz/commit/08be507abce89191d78cd49da60f4501fc910472">08be507ab](https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472)
-
[https://go.googlesource.com/net/+/refs/tags/v0.55.0](https://go.googlesource.com/net/+/refs/tags/v0.55.0)
-
[https://github.com/advisories/GHSA-5cv4-jp36-h3mw](https://redirect.github.com/advisories/GHSA-5cv4-j... (continued)

1037 of 2888 relevant lines covered (35.91%)

1.56 hits per line