[CP 1627] fix(security): weekly CVE remediation 2026-07-26

[ci-penbot-01]

cp of pensando/gpu-operator#1627

---

Source PR Description (pensando/gpu-operator#1627):

Summary

Weekly automated CVE remediation by cve-bot.

Baseline scan: 5 HIGH/CRITICAL CVEs
After fixes: 4 HIGH/CRITICAL CVEs
Fixed: 1 CVEs

What changed

 go.mod                                             | 12 +++++-------
 go.sum                                             | 20 ++++++++++----------
 vendor/golang.org/x/text/unicode/norm/forminfo.go  |  9 ++++++++-
 vendor/golang.org/x/text/unicode/norm/iter.go      |  8 ++------
 vendor/golang.org/x/text/unicode/norm/normalize.go | 20 ++++++++++----------
 vendor/modules.txt                                 | 15 +++++++--------
 6 files changed, 42 insertions(+), 42 deletions(-)

Unfixable CVEs

• CVE-2026-25681 golang.org/x/net
• CVE-2026-27136 golang.org/x/net
• CVE-2026-33814 golang.org/x/net
• CVE-2026-39821 golang.org/x/net

Notes

• Automated by cve-bot
• Review required before merge

Cherrypick triggered by: ACP-Automation

[spraveenio]

LGTM