Bump golang.org/x/net to v0.62.0

Merged
RO
6h ago
+4-4

Trivy started failing today (13:14 UTC) on two new advisories in golang.org/x/net/html that are fixed in v0.62.0:

  • CVE-2026-78661: quadratic complexity when coalescing text nodes
  • CVE-2026-97045: ancestor namespace transitions when rendering raw text

They surfaced on #985 (code-scanning alerts 345 and 346). Main fails the same scan now.

This PR changes go.mod/go.sum and refreshes the Nix vendorHash via make update-nix-hash, which also verified the Nix build. bin/ci passes. govulncheck shows no vulnerable code paths called.

The CLI doesn't import x/net/html directly. It comes in through dependencies.

Summary by cubic

Upgrades golang.org/x/net to v0.62.0, fixing CVE-2026-78661 and CVE-2026-97045 in x/net/html that Trivy flags as of today. Also refreshes the Nix vendorHash to match the new dependencies.