build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0

[dependabot]

Bumps golang.org/x/net from 0.53.0 to 0.55.0.

Commits

• 7770ec4 go.mod: update golang.org/x dependencies
• 4ece7b6 html: escape greater-than symbol in doctype identifiers
• 08be507 html: improve Noah's Ark clause performance
• a8fb2fe html: properly render fostered elements in foreign content
• 0dc5b7a html: properly check namespace in "in body" any other end tag
• a452f3c html: ignore duplicate attributes during tokenization
• f865199 quic: fix appendMaxDataFrame erroneously accumulating sentLimit
• 210ed3c quic: establish a "happened-before" relationship between stream write and read
• ad8140e quic: fix buffer slicing when handling overlapping stream data
• 23ee2ef http2: avoid API changes when built with go1.27
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[kusari-inspector]

Kusari Analysis Results:

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

The code security analysis returned a clean result with zero issues across all scanned files, which is a positive signal. However, the dependency analysis identified a critical concern that warrants attention before merging. The transitive dependency golang.org/x/crypto, pulled in via github.com/ossf/scorecard/v5, is being updated to v0.51.0, which carries 13 active advisories including 8 HIGH severity vulnerabilities. These include SSH authentication bypass (CVE-2026-46595), FIDO/U2F physical interaction bypass (CVE-2026-39831), key constraint enforcement failures (CVE-2026-39832, CVE-2026-39833, CVE-2026-42508), server deadlock via DoS (CVE-2026-39830), infinite loop on large writes (CVE-2026-39834), and a byte arithmetic underflow causing server panic (CVE-2026-46597). These vulnerabilities span authentication bypass, integrity failures, and availability impacts — posing real business risk if the application or its toolchain uses SSH or cryptographic agent features. A fixed version (v0.53.0) is already available. We strongly recommend running 'go get golang.org/x/crypto@v0.53.0' and verifying compatibility with github.com/ossf/scorecard/v5, or upgrading scorecard/v5 to a version that transitively pulls in v0.53.0 or later, before merging this PR.

Note

View full detailed analysis result for more information on the output and the checks that were run.

Required Dependency Mitigations

• golang.org/x/crypto v0.51.0 (transitive via github.com/ossf/scorecard/v5) still contains 13 active vulnerabilities. We strongly recommend addressing this before merging.

Dependency path: github.com/ossf/scorecard/v5 → golang.org/x/crypto (vulnerable)

Key critical/high severity advisories in v0.51.0:

• CVE-2026-46595 (GHSA-x527-x647-q7gg): VerifiedPublicKeyCallback permissions skip enforcement — auth bypass, CVSS C:H I:H A:L, Scope Changed
• CVE-2026-39831 (GHSA-89gr-r52h-f8rx): Bypass of FIDO/U2F physical interaction — C:H I:H
• CVE-2026-39832 (GHSA-f5wc-c3c7-36mc): Agent constraints dropped when forwarding keys — C:H I:H
• CVE-2026-39833 (GHSA-jppx-rxg9-jmrx): Key constraints not enforced — C:H I:H
• CVE-2026-42508 (GHSA-5cgq-3rg8-m6cv): Auth bypass via unenforced @Revoked status — C:H I:H
• CVE-2026-39830 (GHSA-vgwf-h737-ff37): Server deadlock on unexpected responses — C:H A:H
• CVE-2026-39834 (GHSA-rm3j-f69w-wqmq): Infinite loop on large channel writes — I:H A:H
• CVE-2026-46597 (GHSA-q4h4-gmj2-qvw2): Byte arithmetic underflow causing server panic — A:H

Fix: Upgrade golang.org/x/crypto to v0.53.0 by running:
go get golang.org/x/crypto@v0.53.0

Note: Since this is a transitive dependency pulled in by github.com/ossf/scorecard/v5, verify that scorecard/v5 supports golang.org/x/crypto@v0.53.0 or consider upgrading scorecard/v5 to a version that pulls in a fixed crypto release.

---

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 6bba2dd, performed at: 2026-07-04T05:26:35Z

Found this helpful? Give it a 👍 or 👎 reaction!