[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/net	v0.33.0 → v0.55.0

---

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

CVE-2025-22870 / GHSA-qxp5-gwg8-xv66

More information

Details

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-22870
• https://go.dev/cl/654697
• https://go.dev/issue/71984
• https://pkg.go.dev/vuln/GO-2025-3503
• http://www.openwall.com/lists/oss-security/2025/03/07/2
• https://security.netapp.com/advisory/ntap-20250509-0007
• https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ
• https://github.com/advisories/GHSA-qxp5-gwg8-xv66

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

golang.org/x/net vulnerable to Cross-site Scripting

CVE-2025-22872 / GHSA-vvgc-356p-c3xw

More information

Details

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-22872
• https://go.dev/cl/662715
• https://go.dev/issue/73070
• https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
• https://pkg.go.dev/vuln/GO-2025-3595
• https://security.netapp.com/advisory/ntap-20250516-0007
• https://github.com/advisories/GHSA-vvgc-356p-c3xw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Go Net HTML parser is vulnerable to denial of service

CVE-2026-25680 / GHSA-5cv4-jp36-h3mw

More information

Details

In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-25680
• https://go.dev/cl/781702
• https://go.dev/issue/79573
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://pkg.go.dev/vuln/GO-2026-5028
• https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472
• https://go.googlesource.com/net/+/refs/tags/v0.55.0
• https://github.com/advisories/GHSA-5cv4-jp36-h3mw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

go: -d flag is deprecated. -d=true is a no-op
go: downloading github.com/golang/protobuf v1.5.4
go: downloading google.golang.org/protobuf v1.34.2
go: github.com/googleapis/conformance-tests/bigtable/v2 imports
	github.com/googleapis/conformance-tests/bigtable/v2/generated/google/cloud/conformance/bigtable/v2: cannot find module providing package github.com/googleapis/conformance-tests/bigtable/v2/generated/google/cloud/conformance/bigtable/v2
go: github.com/googleapis/conformance-tests/firestore/v1 imports
	github.com/googleapis/conformance-tests/firestore/v1/generated/google/cloud/conformance/firestore/v1: cannot find module providing package github.com/googleapis/conformance-tests/firestore/v1/generated/google/cloud/conformance/firestore/v1
go: github.com/googleapis/conformance-tests/storage/v1 imports
	github.com/googleapis/conformance-tests/storage/v1/generated/google/cloud/conformance/storage/v1: cannot find module providing package github.com/googleapis/conformance-tests/storage/v1/generated/google/cloud/conformance/storage/v1
go: module github.com/golang/protobuf is deprecated: Use the "google.golang.org/protobuf" module instead.