[renovate]

Summary

Bump golang.org/x/net from v0.61.0 to v0.62.0 to fix two security advisories in its html package. The change touches only go.mod and go.sum; no source code changes.

Why

v0.61.0 is affected by:

• GO-2026-6860 / CVE-2026-78661: the HTML parser coalesced adjacent text nodes by string concatenation, so inputs with many short text runs separated by ignored end tags (such as a</x>) caused quadratic allocation and copying.
• GO-2026-6866 / CVE-2026-97045: when rendering raw text, the renderer stopped checking namespace transitions at the nearest foreign ancestor, so a re-parse of the rendered output could place a subtree in a different foreign namespace.

Ark's HTML provider parses repository files with golang.org/x/net/html, so the CI vulncheck job failed on main and on every open PR until this update.

Verification

• CI on d4aad97: all 28 checks passed (unit, race, native tests, filesystem security, lint, vulncheck, fuzz smoke, release snapshot and binaries, Homebrew e2e, CI gate).
• go mod verify: all modules verified.
• govulncheck ./... (v1.9.0, Go 1.27.2): no vulnerabilities reported for golang.org/x/net. The only remaining finding is GO-2026-6809 in the standard library's crypto/x509 (fixed in Go 1.27.3), which Ark's code does not call and which is unrelated to this change.
• go vet ./... and the full test suite passed locally; the HTML provider's tests also passed under -race.

---

This PR was generated by Mend Renovate.