[scality-renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
golang.org/x/mod	v0.37.0 → v0.40.0

---

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

BIT-golang-2026-56865 / CVE-2026-56865 / GO-2026-6179

More information

Details

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

Unknown

References

• https://go.dev/issue/80744
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/814960
• https://go.dev/cl/815020

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

BIT-golang-2026-56864 / CVE-2026-56864 / GO-2026-6180

More information

Details

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.

This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

Unknown

References

• https://go.dev/issue/80745
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/815000
• https://go.dev/cl/815020

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[scality-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.57.0 -> v0.58.0
golang.org/x/text	v0.40.0 -> v0.41.0
golang.org/x/tools	v0.47.0 -> v0.49.0

[github-actions]

Dependency Bump Evaluation

Version change: golang.org/x/mod v0.37.0 -> v0.40.0
Semver bump type: minor (pre-1.0, multiple releases)

Changes:

• golang.org/x/mod v0.37.0 -> v0.40.0 (security fix)
• go get also raised other golang.org/x modules to meet minimum version selection: net v0.57.0 -> v0.58.0, text v0.40.0 -> v0.41.0, tools v0.47.0 -> v0.49.0
• Only go.mod and go.sum change, and every bumped module is // indirect
• The PR was rebased on 2026-10-28 (commit da6fd6c). The bumped versions are the same as before.

Breaking changes: None expected. These are routine minor releases of Go-team modules.

Security concerns: This bump fixes two issues:

• CVE-2026-56865 / GO-2026-6179: forged tiles could bypass verification in golang.org/x/mod/sumdb/tlog
• CVE-2026-56864 / GO-2026-6180: sumdb Lookup accepted unrelated, unauthenticated hashes

Both only affect code that checks modules against a sumdb. The operator never does this, so the shipped binary is not exposed. The bump does clear vulnerability-scanner findings. golang.org/x/net is on the runtime path (HTTP/2 in client-go and the webhook server), so test and test-e2e are the checks to watch.

Impact on codebase: No .go file imports a golang.org/x package directly. These modules come in only through dependencies (controller-runtime, client-go, tooling). No code changes are needed.

Recommendation: REVIEW REQUIRED

Notes: The change is low risk and fixes a security issue, so it should merge once CI is green. It is not auto-approved for two reasons:

1. CI is still running for the rebased commit: build, generate, lint, test and test-e2e have not finished.
2. The commit is authored by scality-renovate[bot]. Only pure dependabot PRs are approved automatically.

Merge once all checks pass.

— Claude Code