[jeremy]

CVE-2026-78661 (HIGH) is fixed in golang.org/x/net v0.62.0. go/ selects x/net v0.58.0 through the oapi-codegen tool's dependencies (go.sum only); this pins v0.62.0 as an indirect requirement. Raising it brings x/sync, x/sys, x/text and x/tools up with it.

Verified: build, vet and tests pass; govulncheck finds nothing; trivy fs reports no HIGH/CRITICAL.

---

Summary by cubic

Bumps golang.org/x/net to v0.62.0 in go/ to fix CVE-2026-78661 (HIGH). The module is pulled in indirectly through the oapi-codegen tool's dependencies (go.sum only), so this pins it as an indirect requirement; x/sync, x/sys, x/text, and x/tools are raised along with it.

Verified: build, vet, and tests pass; govulncheck reports nothing and trivy fs shows no HIGH/CRITICAL findings.

^{Written for commit 1501122. Summary will update on new commits.}

Confidence Score: 5/5

The dependency update appears safe to merge; no actionable issues were found.

Summary

Pins golang.org/x/net to v0.62.0 for the stated security update.

• The Go SDK now resolves x/net v0.62.0 and newer related modules.

_{Reviews (1) · Last reviewed commit: "Bump golang.org/x/net to v0.62.0 for CVE..." · Reviewed by Greptile}

[Copilot]

🟢 Approved

There are no active review issues for the dependency updates intended to address CVE-2026-78661.

No open issues 🎉

What changed in this PR

Updates the Go SDK’s indirect dependencies to address CVE-2026-78661 by pinning golang.org/x/net to v0.62.0.

Changes:

• Adds an explicit indirect requirement for x/net v0.62.0.
• Upgrades x/sync, x/sys, x/text, and x/tools, with matching checksum updates.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
go/​go.sum	Updates checksums for the upgraded dependencies.
go/​go.mod	Pins x/net v0.62.0 and raises related indirect dependencies.

_{Review effort: Balanced}

[cubic-dev-ai]

No issues found across 2 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}