chore(deps): fix vulnerabilities reported by govulncheck

[github-actions]

Vulnerability Report

stdlib → v1.26.9

GO-2026-6599 (CVE-2026-94448)

Reset context tracking on consecutive template expressions in html/template

References

• https://go.dev/cl/839866
• https://go.dev/issue/81821
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

GO-2026-6600 (CVE-2026-97030)

Recognize yield as regexp preceder keyword in html/template

References

• https://go.dev/cl/840925
• https://go.dev/issue/81823
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

GO-2026-6603 (CVE-2026-78659)

HTTP/2 server memory exhaustion due to Trailer headers in net/http

References

• https://go.dev/cl/847185
• https://go.dev/cl/847314
• https://go.dev/issue/81857
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

GO-2026-6604 (CVE-2026-56857)

Root.Mkdir(All) can follow junctions out of the root on Windows in os

References

• https://go.dev/cl/847305
• https://go.dev/issue/81739
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

GO-2026-6605 (CVE-2026-56866)

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

References

• https://go.dev/cl/847306
• https://go.dev/issue/81740
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

GO-2026-6607 (CVE-2026-97031)

Reject malformed ECH outer extension references in crypto/tls

References

• https://go.dev/cl/847312
• https://go.dev/issue/81855
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

GO-2026-6608 (CVE-2026-94440)

Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

References

• https://go.dev/cl/847307
• https://go.dev/issue/81741
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

GO-2026-6609 (CVE-2026-78667)

Lack of limit on size of parsed Range headers in net/http

References

• https://go.dev/cl/847309
• https://go.dev/issue/81858
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

GO-2026-6610 (CVE-2026-78660)

HTTP/2 transport accepts malformed framing-related headers in net/http

References

• https://go.dev/cl/835145
• https://go.dev/cl/836385
• https://go.dev/issue/81115
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

GO-2026-6611 (CVE-2026-78669)

Excessive CPU consumption from repeated initial window changes in net/http

References

• https://go.dev/cl/847186
• https://go.dev/cl/847308
• https://go.dev/issue/81742
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

GO-2026-6612 (CVE-2026-78663)

Double flow control refund on HTTP/2 server streams in net/http

References

• https://go.dev/cl/847187
• https://go.dev/cl/847310
• https://go.dev/issue/81743
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

GO-2026-6613 (CVE-2026-94439)

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

References

• https://go.dev/cl/847311
• https://go.dev/issue/81744
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

GO-2026-6617 (CVE-2026-97032)

HTTP/2 server crash due to HPACK encoder race in net/http

References

• https://go.dev/cl/847188
• https://go.dev/cl/847313
• https://go.dev/issue/81867
• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs