fix(deps): remediate CVE-2026-56864 and CVE-2026-71556

[plural-copilot]

Summary

Remediates the Go dependency findings reported for ghcr.io/pluralsh/console:sha-02c8a53 in their mapped application source: this pluralsh/plural-cli repository builds the plural CLI binary. Per the Application Codebase mapping, these Go findings belong here—not in pluralsh/console.

• CVE-2026-56864: golang.org/x/mod resolved version v0.37.0 → v0.40.0.
• CVE-2026-71556: github.com/go-git/go-git/v5 resolved version v5.19.1 → v5.19.2.
• The compatible transitive golang.org/x/* versions selected by Go tooling were regenerated in go.mod and go.sum.

Scope

Changed only:

• go.mod — direct go-git update, indirect x/mod update, and tool-selected compatible transitive Go module versions.
• go.sum — corresponding checksums.

No CLI source code, unrelated image repository, GitOps manifest, or image configuration was changed.

Build/image-path confirmation

The root module is github.com/pluralsh/plural-cli; ./cmd/plural is the CLI entry point. The root Dockerfile copies go.mod/go.sum, runs go mod download, and builds ./cmd/plural. CI uses this Dockerfile to build ghcr.io/pluralsh/plural-cli.

Validation

Passed:

go mod verify
go list -m all | grep -E '^(github.com/go-git/go-git/v5|golang.org/x/mod) '
# github.com/go-git/go-git/v5 v5.19.2
# golang.org/x/mod v0.40.0

go build -o /tmp/plural ./cmd/plural
/tmp/plural --help >/dev/null
go test -v -race ./pkg/... ./cmd/command/...
git diff --check

The race-enabled test command was run successfully in golang:1.26.5-bookworm because the repository's Alpine builder image lacks CGO support required by -race.

Also attempted the repository Dockerfile build with a deliberate 15-minute limit. It reached the final CGO_ENABLED=0 CLI compilation stage, then was cancelled by the time limit—not by a compilation error. The equivalent CLI build completed successfully above.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create exactly one PR in this repository remediating vulnerabilities identified in ghcr.io/pluralsh/console:sha-02c8a53. The Application Codebase mapping explicitly says Go vulnerabilities in the console image map to this pluralsh/plural-cli repo (the plural CLI binary), not pluralsh/console....
🔗 Run history	View run history

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​crypto@​v0.53.0 ⏵ v0.55.0
	golang.org/​x/​text@​v0.39.0 ⏵ v0.41.0	+1
	github.com/​go-git/​go-git/​v5@​v5.19.1 ⏵ v5.19.2	+1	+18
	golang.org/​x/​term@​v0.44.0 ⏵ v0.45.0

View full report

[greptile-apps]

Greptile Summary

This PR updates Go dependencies to remediate the identified go-git and x/mod vulnerabilities.

• Updates github.com/go-git/go-git/v5 from v5.19.1 to v5.19.2.
• Updates golang.org/x/mod from v0.37.0 to v0.40.0.
• Regenerates compatible golang.org/x/* versions and corresponding module checksums.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code-triggered failures identified.

The changes are limited to coherent dependency and checksum updates, and the investigated advisory paths either remain unchanged from the base branch or are not reachable from this CLI.

Important Files Changed

Filename	Overview
go.mod	Updates the targeted dependencies and compatible transitive Go modules; no concrete compatibility or reachable security regression was identified.
go.sum	Replaces checksums consistently for the module versions selected in go.mod.

_{Reviews (1): Last reviewed commit: "fix(deps): remediate Go module vulnerabi..." | Re-trigger Greptile}