Bump golang.org/x/net from 0.49.0 to 0.55.0

[dependabot]

Bumps golang.org/x/net from 0.49.0 to 0.55.0.

Commits

• 7770ec4 go.mod: update golang.org/x dependencies
• 4ece7b6 html: escape greater-than symbol in doctype identifiers
• 08be507 html: improve Noah's Ark clause performance
• a8fb2fe html: properly render fostered elements in foreign content
• 0dc5b7a html: properly check namespace in "in body" any other end tag
• a452f3c html: ignore duplicate attributes during tokenization
• f865199 quic: fix appendMaxDataFrame erroneously accumulating sentLimit
• 210ed3c quic: establish a "happened-before" relationship between stream write and read
• ad8140e quic: fix buffer slicing when handling overlapping stream data
• 23ee2ef http2: avoid API changes when built with go1.27
• Additional commits viewable in compare view

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

go.mod

Name	Version	Vulnerability	Severity
golang.org/x/crypto	0.51.0	golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses	critical
		golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed	critical
		golang.org/x/crypto vulnerable to infinite loop on large channel writes	critical
		golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status	critical
		golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement	critical
		golang.org/x/crypto doesn't enforce invoking key constraints	critical
		golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys	critical
		golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic	high
		golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS	high
		golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions	moderate
		golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow	moderate
		golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS	moderate
		golang.org/x/crypto: Invoking pathological inputs can lead to client panic	moderate

Only included vulnerabilities with severity moderate or higher.

License Issues

go.mod

Package	Version	License	Issue Type
golang.org/x/net	0.55.0	Null	Unknown License
golang.org/x/sys	0.45.0	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
gomod/golang.org/x/crypto	0.51.0	Unknown	Unknown
gomod/golang.org/x/net	0.55.0	Unknown	Unknown
gomod/golang.org/x/sync	0.20.0	Unknown	Unknown
gomod/golang.org/x/sys	0.45.0	Unknown	Unknown
gomod/golang.org/x/text	0.37.0	Unknown	Unknown

Scanned Files

• go.mod

[github-actions]

⚠️ Security Dependency Review Failed ⚠️

This pull request introduces dependencies with security vulnerabilities of moderate severity or higher.

Vulnerable Dependencies:

📦 golang.org/x/crypto@0.51.0

What to do next?

1. Review the vulnerability details in the Dependency Review Comment above, specifically the "Vulnerabilities" section
2. Click on the links in the "Vulnerability" section to see the details of the vulnerability
3. If multiple versions of the same package are vulnerable, please update to the common latest non-vulnerable version
4. If you are unsure about the vulnerability, please contact the security engineer
5. If the vulnerability cannot be avoided (can't upgrade, or need to keep), contact #security on slack to get it added to the allowlist

Security Engineering contact: #security on slack