fix: upgrade golang.org/x/mod to v0.40.0 for GO-2026-6180
Summary
Upgraded golang.org/x/mod from v0.38.0 to v0.40.0, the first release identified by the assessment as resolving GO-2026-6180-golang.org/x/mod. The module graph and checksums were refreshed so the patched dependency is what the repository now resolves.
Vulnerability Fixed
GO-2026-6180-golang.org/x/mod (HIGH): a malicious GOSUMDB could serve arbitrary module content not anchored in the transparency log when golang.org/x/mod/sumdb.Client.Lookup processed colluding proxy and checksum database responses.
Changes Made
- Updated
golang.org/x/modingo.modfromv0.38.0tov0.40.0, matching the fixed release identified in the assessment. - Refreshed
go.sumand the resolved module graph entries required by the newgolang.org/x/modrelease (golang.org/x/crypto,golang.org/x/net,golang.org/x/text, andgolang.org/x/tools). - Kept the remediation limited to dependency metadata only; no application code or build scripts were changed.
Verification
Ran syft dir:/workspace/run/repo -o cyclonedx-json=/workspace/run/sbom.json and then GRYPE_DB_AUTO_UPDATE=false grype sbom:/workspace/run/sbom.json --only-fixed -o json against the patched repository SBOM. Classification: resolved. grype no longer reports GO-2026-6180-golang.org/x/mod for the scanned target /workspace/run/repo.