fix(deps): vuln minor upgrades — 6 packages (minor: 6) [go.mod]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 6 packages upgraded (MINOR changes included)

Manifests changed:

• go.mod (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
google.golang.org/grpc	v1.54.0	v1.83.2	minor	Direct	3 CRITICAL, 6 HIGH
golang.org/x/net	v0.8.0	v0.58.0	minor	Transitive	2 CRITICAL, 8 HIGH, 24 MEDIUM, 2 UNKNOWN
github.com/golang/glog	v1.1.1	v1.2.5	minor	Transitive	2 HIGH, 1 MEDIUM
google.golang.org/protobuf	v1.30.0	v1.36.12	minor	Direct	2 MEDIUM
golang.org/x/sys	v0.6.0	v0.47.0	minor	Transitive	1 UNKNOWN
golang.org/x/text	v0.9.0	v0.41.0	minor	Transitive	1 UNKNOWN

---

Security Details

🚨 Critical & High Severity (21 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
golang.org/x/net	CVE-2026-39821	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.8.0	-	-
golang.org/x/net	GO-2026-5026	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.8.0	0.55.0	-
google.golang.org/grpc	CVE-2026-33186	critical	gRPC-Go has an authorization bypass via missing leading slash in :path	v1.54.0	-	-
google.golang.org/grpc	GHSA-p77j-4mvh-x3m3	CRITICAL	gRPC-Go has an authorization bypass via missing leading slash in :path	v1.54.0	1.79.3	-
google.golang.org/grpc	GO-2026-4762	critical	Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc	v1.54.0	1.79.3	-
github.com/golang/glog	GO-2025-3372	high	Vulnerability when creating log files in github.com/golang/glog	v1.1.1	1.2.4	-
github.com/golang/glog	CVE-2024-45339	high	Vulnerability when creating log files in github.com/golang/glog	v1.1.1	-	-
golang.org/x/net	CVE-2026-33814	high	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.8.0	-	-
golang.org/x/net	GO-2026-4918	high	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.8.0	0.53.0	-
golang.org/x/net	CVE-2023-44487	high	This package is related to CVE CVE-2023-44487 which was detected by cisa.gov as actively being exploited in the wild	v0.8.0	-	-
golang.org/x/net	GO-2023-2102	HIGH	HTTP/2 rapid reset can cause excessive work in net/http	v0.8.0	0.17.0	-
golang.org/x/net	CVE-2023-39325	HIGH	HTTP/2 rapid reset can cause excessive work in net/http	v0.8.0	-	-
golang.org/x/net	GHSA-4374-p667-p6c8	HIGH	HTTP/2 rapid reset can cause excessive work in net/http	v0.8.0	0.17.0	-
golang.org/x/net	GO-2024-3333	HIGH	Non-linear parsing of case-insensitive content in golang.org/x/net/html	v0.8.0	0.33.0	-
golang.org/x/net	GHSA-w32m-9786-jp63	HIGH	Non-linear parsing of case-insensitive content in golang.org/x/net/html	v0.8.0	-	-
google.golang.org/grpc	GHSA-vp52-pcj8-j9qc	HIGH	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation	v1.54.0	1.83.1	-
google.golang.org/grpc	CVE-2026-84304	HIGH	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation	v1.54.0	-	-
google.golang.org/grpc	GO-2026-6061	HIGH	Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc	v1.54.0	1.82.1	-
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	HIGH	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities	v1.54.0	1.82.1	-
google.golang.org/grpc	GHSA-m425-mq94-257g	HIGH	gRPC-Go HTTP/2 Rapid Reset vulnerability	v1.54.0	1.56.3	-
google.golang.org/grpc	GO-2023-2153	HIGH	Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc	v1.54.0	1.56.3	-

ℹ️ Other Vulnerabilities (31)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
golang.org/x/net	GO-2026-5028	medium	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.8.0	0.55.0	-
golang.org/x/net	CVE-2026-42506	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.8.0	-	-
golang.org/x/net	GO-2026-5025	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.8.0	0.55.0	-
golang.org/x/net	CVE-2026-42502	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.8.0	-	-
golang.org/x/net	GO-2026-5027	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.8.0	0.55.0	-
golang.org/x/net	CVE-2026-27136	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.8.0	-	-
golang.org/x/net	GO-2026-5029	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.8.0	0.55.0	-
golang.org/x/net	CVE-2026-25680	medium	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.8.0	-	-
golang.org/x/net	CVE-2026-25681	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.8.0	-	-
golang.org/x/net	GO-2026-5030	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.8.0	0.55.0	-
github.com/golang/glog	GHSA-6wxm-mpqj-6jpf	MODERATE	Insecure Temporary File usage in github.com/golang/glog	v1.1.1	1.2.4	-
golang.org/x/net	GO-2025-3595	MODERATE	Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net	v0.8.0	0.38.0	-
golang.org/x/net	CVE-2023-44487	MODERATE	-	v0.8.0	-	-
golang.org/x/net	GO-2023-1988	MODERATE	Improper rendering of text nodes in golang.org/x/net/html	v0.8.0	0.13.0	-
golang.org/x/net	CVE-2023-3978	MODERATE	Improper rendering of text nodes in golang.org/x/net/html	v0.8.0	-	-
golang.org/x/net	GHSA-2wrh-6pvc-2jm9	MODERATE	Improper rendering of text nodes in golang.org/x/net/html	v0.8.0	0.13.0	-
golang.org/x/net	GO-2026-4440	MODERATE	Quadratic parsing complexity in golang.org/x/net/html	v0.8.0	0.45.0	-
golang.org/x/net	GHSA-w4gw-w5jq-g9jh	MODERATE	golang.org/x/net/html has a Quadratic Parsing Complexity issue	v0.8.0	-	-
golang.org/x/net	GO-2024-2687	MODERATE	HTTP/2 CONTINUATION flood in net/http	v0.8.0	0.23.0	-
golang.org/x/net	GHSA-4v7x-pqxf-cx7m	MODERATE	net/http, x/net/http2: close connections when receiving too many headers	v0.8.0	0.23.0	-
golang.org/x/net	GHSA-qxp5-gwg8-xv66	MODERATE	HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net	v0.8.0	0.36.0	-
golang.org/x/net	GHSA-qppj-fm5r-hxr3	MODERATE	HTTP/2 Stream Cancellation Attack	v0.8.0	0.17.0	-
golang.org/x/net	GO-2025-3503	MODERATE	HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net	v0.8.0	0.36.0	-
golang.org/x/net	GHSA-vvgc-356p-c3xw	MODERATE	golang.org/x/net vulnerable to Cross-site Scripting	v0.8.0	0.38.0	-
golang.org/x/net	GHSA-5cv4-jp36-h3mw	MODERATE	Go Net HTML parser is vulnerable to denial of service	v0.8.0	0.55.0	-
google.golang.org/protobuf	GHSA-8r3f-844c-mc37	MODERATE	Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON	v1.30.0	1.33.0	-
google.golang.org/protobuf	GO-2024-2611	MODERATE	Infinite loop in JSON unmarshaling in google.golang.org/protobuf	v1.30.0	1.33.0	-
golang.org/x/net	GO-2026-5942	unknown	Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage	v0.8.0	0.56.0	-
golang.org/x/net	GO-2026-4441	unknown	Infinite parsing loop in golang.org/x/net	v0.8.0	0.45.0	-
golang.org/x/sys	GO-2026-5024	unknown	Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows	v0.6.0	0.44.0	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.9.0	0.39.0	-

⚠️ Dependencies that have Reached EOL (6)

Dependency	Unsafe Version	EOL Date	New Version	Path	Case
github.com/golang/glog	v1.1.1	Mar 22, 2026	v1.2.5	go.mod	-
golang.org/x/net	v0.8.0	Mar 5, 2026	v0.58.0	go.mod	-
golang.org/x/sys	v0.6.0	Mar 4, 2026	v0.47.0	go.mod	-
golang.org/x/text	v0.9.0	Apr 6, 2026	v0.41.0	go.mod	-
google.golang.org/grpc	v1.54.0	Mar 21, 2026	v1.83.2	go.mod	-
google.golang.org/protobuf	v1.30.0	Mar 16, 2026	v1.36.12	go.mod	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-datadog-prod-us1]

✨ Unblock PR with BitsAI

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

testing | tests — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

4 failed tests. 'Expected broker 1001, got 1002' in brokers_test.go:108 leads to assertion failures in TestSortPseudoShuffle and others.

📋 Copy fix prompt

CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Before you start, set up the Datadog software-delivery tooling so you can
query the CI data yourself:

1. Check whether you already have the Datadog software-delivery MCP tools
   (e.g. a `search_datadog_ci_pipeline_events` tool) and the `unblock-pr` skill.
2. If either is missing, STOP and ask me for permission before installing
   anything. Do not install or run anything until I have said yes.
3. Only with my explicit approval, set up the Datadog software-delivery MCP
   server and skills by following:
     https://docs.datadoghq.com/getting_started/software_delivery_mcp_tools/
   then restart so the skill is picked up.
4. If I decline, skip all of the above and work from the context below alone.

Then run /unblock-pr — it will pull the CI data itself. The job context below is what we already know.

If /unblock-pr is not available — because I declined the setup above, or it did not install — work from the context below instead.

Datadog has already classified this failure as caused by changes in this PR.
Take that as given and work the fix:

1. Locate the change. Diff this branch against its base and find the change
   that produces this error. Explain the mechanism, don't just name a file:
     git fetch origin && git diff $(git merge-base origin/master HEAD)...HEAD
2. Reproduce it locally. Run the failing job's command or test before
   proposing anything.
3. Propose the smallest fix that addresses the root cause — not a workaround,
   not a broadened assertion, not a disabled or skipped test.
4. Re-run the same command to confirm, and say exactly what you ran.
5. If the failure turns out to be intermittent rather than deterministic, say
   so plainly instead of "fixing" it — that is a flaky test, and patching it
   hides the problem.

If the right move is to re-run the job rather than change code, use the job
link in the context below. For GitHub Actions: `gh run rerun <run-id> --failed`,
where the run ID is the number after `/runs/` in that URL (not the trailing
number, which is the job ID).

Branch: engraver-auto-version-upgrade/minorpatch/go/0-1788772122

testing | tests
Commit: 5f286175cf749b17c61ed6723a5b09d55292542c
Error (code / test):
4 failed tests. 'Expected broker 1001, got 1002' in brokers_test.go:108 leads to assertion failures in TestSortPseudoShuffle and others.
CI job: https://github.com/DataDog/kafka-kit/actions/runs/34104388784/job/101685936339

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 5f28617 | Docs | View more details | Give us feedback!}