chore(deps): fix vulnerabilities reported by govulncheck

[github-actions]

Vulnerability Report

stdlib → v1.25.13

GO-2026-5026 (CVE-2026-39821)

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

References

• https://go.dev/cl/767220
• https://go.dev/issue/78760
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://groups.google.com/g/golang-announce/c/94pEornpRlI

GO-2026-5972 (CVE-2026-33818)

Enforce maximum recursion depth in encoding/asn1

References

• https://go.dev/issue/80405
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/814980

GO-2026-6088 (CVE-2026-56859)

Add recursion depth guard during decode in encoding/xml

References

• https://go.dev/issue/80481
• https://go.dev/cl/803320
• https://groups.google.com/g/golang-announce/c/94pEornpRlI

GO-2026-6089 (CVE-2026-56853)

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

References

• https://go.dev/issue/80205
• https://go.dev/cl/795540
• https://groups.google.com/g/golang-announce/c/94pEornpRlI

GO-2026-6090 (CVE-2026-56862)

Limit handshake messages we are willing to accept post-handshake in crypto/tls

References

• https://go.dev/issue/80528
• https://go.dev/cl/804261
• https://groups.google.com/g/golang-announce/c/94pEornpRlI

GO-2026-6091 (CVE-2026-56858)

Fix Javascript regexp context tracking in html/template

References

• https://go.dev/issue/80435
• https://go.dev/cl/807100
• https://groups.google.com/g/golang-announce/c/94pEornpRlI

GO-2026-6218 (CVE-2026-56860)

Avoid quadratic complexity in resolvePath in net/url

References

• https://go.dev/cl/803681
• https://go.dev/issue/80494
• https://groups.google.com/g/golang-announce/c/94pEornpRlI