Bump golang.org/x/text to v0.41.0 for CVE-2026-56851
Clears the red Trivy (Go SDK) check on main (Security run 39110998160, job "Trivy (Go SDK)", on a2a29458):
golang.org/x/text │ CVE-2026-56851 │ HIGH │ fixed │ v0.40.0 │ 0.41.0 │ The Nickname profile can panic with an out-of-bounds slice
Bumps golang.org/x/text v0.40.0 → v0.41.0 (the fixed version) in go/go.mod with go get golang.org/x/text@v0.41.0 && go mod tidy. Diff is the one require line and the two go.sum hashes.
go/go.modis the only module that pins x/text. The conformance runner,scripts/check-wrapper-driftandscripts/gen-catalogdon't require it.- It is
// indirect, reached only through theoapi-codegentool directive (go mod why -m→oapi-codegen/v2/pkg/codegen→x/text/cases).go list -deps -test ./...ingo/links zerogolang.org/x/textmodule packages (only the stdlib'svendor/golang.org/x/text), so the SDK's compiled code doesn't change. go.work.sumdoesn't change: it already holds the v0.41.0 hashes.- I stayed on 0.41.0 rather than 0.43.0 to keep the bump minimal.
Verification
On local macOS for Trivy; on linux/amd64 with GOTOOLCHAIN=go1.26.9 (go.mod's toolchain) for everything else.
| Command | Result |
|---|---|
trivy fs --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 ./go (Trivy 0.74.0) | 0 vulnerabilities. Control: the same scan on origin/main's go.mod/go.sum reports CVE-2026-56851 and exits 1 |
cd go && go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./... | No vulnerabilities found |
cd go && go build ./... && go vet ./... | pass |
cd go && go test -count=1 ./... | all packages ok |
cd go && go test -race -count=1 ./... | all packages ok (see note) |
make conformance-go | Passed: 310, Failed: 0, Skipped: 2, Total: 312 |
./scripts/assert-lockfiles-unchanged --verify-clean | Dependency manifests match the committed tree |
Note on the race run: the first -race run failed TestScenarioDriverRejectsUnmatchedActions/an_unmatched_mint_seam_call at 0.50s. That test runs under underShortWatchdog's 500ms watchdog, and the host's load average was about 164 on 32 cores at the time. Three targeted reruns, three full eventfeed race runs and a second full ./... race run all passed, and the same targeted test passed 3/3 on main's go.mod. Because this bump links no new code, I don't think the change caused that failure. The test does look timing-sensitive under heavy load.
Overlap with #997
#997 (prometheus client_golang 1.25) also edits go/go.mod, go/go.sum and go.work.sum. The go.mod/go.sum hunks are on different lines. Whichever PR lands second needs a trivial rebase, then go mod tidy, plus a go.work.sum refresh if one is needed.
Summary by cubic
Bumps golang.org/x/text from v0.40.0 to v0.41.0 to fix CVE-2026-56851, a HIGH severity vulnerability in the Nickname profile that could panic with an out-of-bounds slice read. This clears the failing Trivy (Go SDK) check on main.
The dependency is // indirect, used only by the oapi-codegen tool directive, so no compiled SDK code changes. go.work.sum already holds the v0.41.0 hashes and doesn't change. The bump stays at 0.41.0 rather than the newer 0.43.0 to keep it minimal.
Verification passes: Trivy and govulncheck report no vulnerabilities; build, vet, tests, race tests, and the conformance suite all pass. A single race test failure was timing-sensitive under heavy load and reproduced independently of this change.