CVE-2026-78661 (HIGH) is fixed in golang.org/x/net v0.62.0. go/ selects x/net v0.58.0 through the oapi-codegen tool's dependencies (go.sum only); this pins v0.62.0 as an indirect requirement. Raising it brings x/sync, x/sys, x/text and x/tools up with it.
Verified: build, vet and tests pass; govulncheck finds nothing; trivy fs reports no HIGH/CRITICAL.
Summary by cubic
Bumps golang.org/x/net to v0.62.0 in go/ to fix CVE-2026-78661 (HIGH). The module is pulled in indirectly through the oapi-codegen tool's dependencies (go.sum only), so this pins it as an indirect requirement; x/sync, x/sys, x/text, and x/tools are raised along with it.
Verified: build, vet, and tests pass; govulncheck reports nothing and trivy fs shows no HIGH/CRITICAL findings.
Confidence Score: 5/5
The dependency update appears safe to merge; no actionable issues were found.
Summary
Pins golang.org/x/net to v0.62.0 for the stated security update.
The Go SDK now resolves x/net v0.62.0 and newer related modules.
