fix(deps): update module golang.org/x/net to v0.56.0 [security]

[alaudaa-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/net	v0.55.0 -> v0.56.0

---

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

BIT-golang-2026-46600 / CVE-2026-46600 / GO-2026-5942

More information

Details

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Severity

Unknown

References

• https://go.dev/cl/786345
• https://go.dev/issue/79795
• https://groups.google.com/g/golang-announce/c/94pEornpRlI

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[alaudaa-renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 4 additional dependencies were updated

Details:

Package	Change
golang.org/x/crypto	v0.52.0 -> v0.53.0
golang.org/x/sync	v0.20.0 -> v0.21.0
golang.org/x/sys	v0.45.0 -> v0.46.0
golang.org/x/text	v0.37.0 -> v0.38.0

[alaudabot]

🤖 AI Code Review

Property	Value
Model	opencode/minimax-m2.5-free
Style	strict
Issues Found	0
Config Source	centralized
Profile	❌ Not Found
Personalized Prompt	❌ No
Prompt Path	.github/review/profiles/alaudadevops/harbor-scanner-trivy/pr-review.md
Alauda Skills	✅ base-acp-operator-list, base-acp-operator-release, base-authoring, base-m365, base-ocp-operator-list, base-skill-setup, builders-alauda-component-e2e-release, builders-alauda-component-upgrade, builders-alauda-pipeline, builders-claudetask-submit, builders-component-knowledge, builders-confluence, builders-dev-mesh-qa, builders-edge-ci-trace, builders-gitlab-ops, builders-helm-operator-generator, builders-install-cluster-plugin, builders-jira, builders-notify-wecom, builders-olm-operator-lifecycle, builders-prd-to-testcase, builders-publish-errata, builders-roadmap-studio, builders-story-split, builders-violet, builders-webapp-testing, cross-repo-add-mirror, cross-repo-publish, devops-add-bug-release-notes, devops-autodns, devops-bundle-csv-baseline-diff, devops-candidate-version-supervisor, devops-connectors-acceptance-test, devops-connectors-explore, devops-connectors-poc-case, devops-connectors-review, devops-connectors-unit-test, devops-connectors-upgrade-test, devops-connectors-write-user-docs, devops-creating-tekton-pipelines, devops-fix-go-vulns, devops-fork-alauda-binary-release, devops-gen-advanced-form-descriptors, devops-jira-rfd-acceptance, devops-knowledge-adoption, devops-pr-review, devops-refresh-containerfile-digests, devops-refresh-containerfile-tags, devops-replace-strings, devops-scan-docker-keywords, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-pipeline-delivery, devops-tekton-refresh-results-tag, devops-tekton-task-delivery, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-tool-report-troubleshoot, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-upgrade-go, devops-upstream-backport-cve, devops-upstream-upgrade
Reviewed at	2026-05-20 00:26:56 UTC

---

Summary

This PR updates the golang.org/x/net dependency from v0.38.0 to v0.53.0 to address multiple security vulnerabilities (CVE-2025-47911, CVE-2025-58190, CVE-2026-33814). The update also includes transitive dependency updates to maintain consistency. The changes are straightforward dependency version bumps in go.mod and corresponding checksum updates in go.sum.

Review Statistics

Category	Count
Critical Issues	0
Warnings	0
Suggestions	1
Files Reviewed	2

Critical Issues

Issues that MUST be addressed before merging (security, bugs, breaking changes)

None. This is a security fix and the dependency updates are appropriate.

Warnings

Issues that SHOULD be addressed but are not blocking

None.

Suggestions

Recommendations for improvement (nice to have)

• [go.mod:20] (refactor/dependency-management): Consider adding a renovate config to pin the golang.org/x/net dependency to allow automatic security updates. This ensures the project stays up-to-date with security patches.

  {
    "extends": ["config:base"],
    "packageRules": [{
      "matchPackagePatterns": ["golang.org/x/*"],
      "matchUpdateTypes": ["security"],
      "automerge": true
    }]
  }
  

Positive Feedback

• The dependency update correctly addresses 3 security vulnerabilities (2 html parsing issues, 1 HTTP/2 issue)
• The go.sum checksums match the go.mod versions correctly
• Transitive dependencies are properly updated (golang.org/x/crypto, x/sys, x/text, x/term)
• This follows the recommended practice of promptly applying security patches

---

---

ℹ️ About this review

This review was automatically generated using the run-actions workflow.

• Shared prompt: .github/prompts/code-review.md
• Config source: centralized
• Profile path: Not Found
• Profile ref: e75e733e9aa1b417a8b3c6441e53495dbcb418ad
• No repository-specific prompt configured
• Alauda skills: base-acp-operator-list, base-acp-operator-release, base-authoring, base-m365, base-ocp-operator-list, base-skill-setup, builders-alauda-component-e2e-release, builders-alauda-component-upgrade, builders-alauda-pipeline, builders-claudetask-submit, builders-component-knowledge, builders-confluence, builders-dev-mesh-qa, builders-edge-ci-trace, builders-gitlab-ops, builders-helm-operator-generator, builders-install-cluster-plugin, builders-jira, builders-notify-wecom, builders-olm-operator-lifecycle, builders-prd-to-testcase, builders-publish-errata, builders-roadmap-studio, builders-story-split, builders-violet, builders-webapp-testing, cross-repo-add-mirror, cross-repo-publish, devops-add-bug-release-notes, devops-autodns, devops-bundle-csv-baseline-diff, devops-candidate-version-supervisor, devops-connectors-acceptance-test, devops-connectors-explore, devops-connectors-poc-case, devops-connectors-review, devops-connectors-unit-test, devops-connectors-upgrade-test, devops-connectors-write-user-docs, devops-creating-tekton-pipelines, devops-fix-go-vulns, devops-fork-alauda-binary-release, devops-gen-advanced-form-descriptors, devops-jira-rfd-acceptance, devops-knowledge-adoption, devops-pr-review, devops-refresh-containerfile-digests, devops-refresh-containerfile-tags, devops-replace-strings, devops-scan-docker-keywords, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-pipeline-delivery, devops-tekton-refresh-results-tag, devops-tekton-task-delivery, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-tool-report-troubleshoot, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-upgrade-go, devops-upstream-backport-cve, devops-upstream-upgrade

[danielfbm]

PR Assist Bot — Owner Approval Needed

This PR targets release branch alauda-v0.34.2. Per policy, release-branch merges require explicit owner approval before the bot proceeds.

PR: AlaudaDevops/harbor-scanner-trivy#49
Branch: alauda-v0.34.2
Type: Security / Dependency update (Renovate)

Please reply with /approve-merge or provide explicit approval for the bot to merge this PR on the next sweep.

[alaudabot]

This PR cleanly patches two CVEs in golang.org/x/net/html (CVE-2025-58190 and CVE-2025-47911) with no blocking issues. The indirect dependency updates are also correct. LGTM.

[alaudabot]

Review Complete

This security dependency update has been reviewed. No critical issues, warnings, or suggestions were found. The PR addresses multiple CVEs (CVE-2025-47911, CVE-2025-58190, CVE-2026-33814) by upgrading golang.org/x/net to v0.53.0.

Recommendation: Merge - security update is safe and necessary.

[alaudabot]

Warning (security/dependency-jump): The golang.org/x/text indirect dependency was updated from v0.23.0 to v0.36.0 — a jump of 13 minor versions. Verify the x/text changelog has been reviewed for any breaking changes that could affect this project.

[alaudabot]

Review Summary

This PR updates golang.org/x/net from v0.38.0 to v0.53.0 to address multiple security vulnerabilities (CVE-2025-47911, CVE-2025-58190, CVE-2026-33814). The changes are straightforward dependency version bumps.

No critical issues found. The dependency updates are appropriate and correctly address the security vulnerabilities.

Suggestions

• Consider adding renovate config to pin golang.org/x/* dependencies for automatic security updates (go.mod:20)

---

Review generated from pr-overview.md

[alaudabot]

Suggestion (refactor/dependency-management): Consider adding renovate config to pin golang.org/x/* dependencies for automatic security updates:

{
  "extends": ["config:base"],
  "packageRules": [{
    "matchPackagePatterns": ["golang.org/x/*"],
    "matchUpdateTypes": ["security"],
    "automerge": true
  }]
}

[alaudaa-renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.