build(deps): Bump golang.org/x/net from 0.56.0 to 0.57.0

[dependabot]

Bumps golang.org/x/net from 0.56.0 to 0.57.0.

Commits

• b8f09f6 go.mod: update golang.org/x dependencies
• f05f21b idna: reject all-ASCII xn-- labels on all Go versions
• 0f748cf internal/http3: clean up stream I/O methods usages in tests
• 0bb961e internal/http3: add net/http.ResponseController support
• 0ca694d webdav: document Dir's lack of defense against filesystem modification
• bd5f1dc http2: initialize Transport on NewClientConn
• 488ff63 bpf: add security considerations to package docs
• 93d1f25 xsrftoken: avoid token collisions
• 5a3baee internal/http3: prevent panic in QPACK decoder due to overflow
• See full diff in compare view

[lklimek]

Dependency Security Review — golang.org/x/net 0.56.0 → 0.57.0

Verdict: SAFE — recommend merge. Net security improvement, no reachable regression risk.

Scope

9 upstream commits, 314+/108- across 15 non-test files. MVS pulls in the module set that x/net@v0.57.0's own go.mod requires — x/crypto 0.53.0→0.54.0, x/sys 0.46→0.47, x/term 0.44→0.45, x/text 0.38.0→0.40.0, x/tools 0.46→0.47, x/sync 0.21→0.22. Not scope creep. This subsumes #1383, #1384, #1387, #1389.

Headline: this PR fixes a live CVE that scanners report as already-fixed

CVE-2026-39821 / GO-2026-5026 (x/net/idna, privilege escalation) is advertised as fixed in v0.55.0. It wasn't — for this repo. The v0.55.0 fix was gated behind unicode16 = unicode.Version >= "16.0.0" (idna/idna.go:29), and Go 1.26.x ships unicode.Version = 15.0.0, so the gate evaluated false and the fix was inert. v0.57.0 removes the gate outright ("that's a specification bug and a security issue. Always return an error").

Verified empirically on the repo's toolchain:

x/net v0.56.0:  idna.Lookup.ToASCII("xn--example-.com") = "example.com"  err=<nil>   ← vulnerable
x/net v0.57.0:  idna.Lookup.ToASCII("xn--example-.com")                  err=idna: invalid label "example-"

Consequence: govulncheck and OSV both report v0.56.0 clean for GO-2026-5026 while the vulnerable behaviour is compiled in. Upstream golang/go#78760 is still open. This PR is the actual remediation.

Known vulnerabilities

ID	Module	Advisory "fixed in"	Base	After PR
CVE-2026-39821 / GO-2026-5026	x/net/idna	0.55.0 (inaccurate)	Vulnerable in practice	Fixed
CVE-2026-56852 / GO-2026-5970	x/text unicode/norm (infinite-loop DoS)	0.39.0	Affected (0.38.0)	Fixed (0.40.0)
GO-2026-5942	x/net/dnsmessage panic	0.56.0	Already fixed	Fixed

OSV returns no advisories against x/net at either version.

Library audit

Sev	Finding	Location	Reachable here?
HIGH	IDNA accepts Punycode that decodes to pure ASCII → hostname allowlist bypass (CWE-1289/863)	idna/idna.go:403	Package linked via grpc→http2; functions not called
MEDIUM	unicode/norm infinite loop on invalid runes (CWE-835)	unicode/norm/{forminfo,iter}.go	In build graph via viper→afero
MEDIUM	xsrftoken clean() escaped :→:: against a : separator, so tokens cross-validate between (userID, actionID) pairs (CWE-352)	xsrftoken/xsrf.go:25	No — not in build graph
LOW	QPACK prefixed-int overflow → panic; now binary.ReadUvarint + MaxInt64 guard	internal/http3/qpack.go:227	No — internal pkg
INFO	http2.Transport nil-t1 lazy-init fix	http2/transport_wrap.go	No — file is //go:build go1.27

No limits removed, no unbounded allocations introduced. The http3 stream.go/server.go churn is net/http.ResponseController support (deadlines, FlushError), not limit relaxation.

Codebase impact

Reachability via go mod why: in the build graph are x/net/netutil (the only direct import — rpc/jsonrpc/server/http_server.go:16, untouched by this diff), x/net/http2, x/net/idna, x/net/trace, x/text/unicode/norm, x/text/secure/bidirule. Not in the graph: x/crypto/ssh, webdav, xsrftoken, internal/http3. x/crypto use is confined to chacha20poly1305, nacl/box, hkdf, curve25519, ripemd160 — none touched by 0.53→0.54.

The IDNA privilege-escalation pattern (allowlist-check the ASCII form, then convert to Unicode) does not exist in tenderdash. CORS/WebSocket origin checking (rpc/jsonrpc/server/ws_handler.go:64-86) uses url.Parse plus case-insensitive matching with no IDNA round-trip. Practical exposure is nil; the value is defence-in-depth plus clearing the module-level CVE.

CI note

The red govulncheck on this PR is not caused by this bump — it is GO-2026-5856 (crypto/tls ECH privacy leak in stdlib go1.26.4), fixed only by moving the toolchain to go1.26.5. That toolchain bump landed on v1.6-dev in #1395, so this branch just needs a rebase to pick it up. Requesting @dependabot rebase next.

Caveat on advisory metadata

Three x/crypto 0.54.0 SSH hardening commits — authorized_keys key-type confusion (7626c50), ssh/agent DSA parameter limits (0471e79), disconnect-message sanitization (6435c37) — carry no CVE or GO- ID. Combined with the inaccurate fixed: 0.55.0 range on GO-2026-5026, golang.org/x/* advisory metadata should not be treated as authoritative for this repo's exposure, and govulncheck alone is insufficient for these modules.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

[lklimek]

@dependabot rebase

[lklimek]

@dependabot rebase

[lklimek]

@dependabot rebase