fix(deps): vuln minor upgrades — 4 packages (minor: 4) [go.mod]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 4 packages upgraded (MINOR changes included)

Manifests changed:

• go.mod (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
golang.org/x/net	v0.38.0	v0.59.0	minor	Transitive	2 CRITICAL, 2 HIGH, 13 MEDIUM, 2 UNKNOWN
golang.org/x/mod	v0.25.0	v0.41.0	minor	Transitive	2 UNKNOWN
golang.org/x/sys	v0.39.0	v0.48.0	minor	Transitive	1 UNKNOWN
golang.org/x/text	v0.25.0	v0.42.0	minor	Transitive	1 UNKNOWN

---

Security Details

🚨 Critical & High Severity (4 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
golang.org/x/net	GO-2026-5026	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.38.0	0.55.0	View
golang.org/x/net	CVE-2026-39821	critical	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.38.0	-	View
golang.org/x/net	CVE-2026-33814	high	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.38.0	-	View
golang.org/x/net	GO-2026-4918	high	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.38.0	0.53.0	View

ℹ️ Other Vulnerabilities (19)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
golang.org/x/net	CVE-2026-25680	medium	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.38.0	-	View
golang.org/x/net	CVE-2026-42502	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.38.0	-	View
golang.org/x/net	GO-2026-5029	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.38.0	0.55.0	View
golang.org/x/net	CVE-2026-27136	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.38.0	-	View
golang.org/x/net	GO-2026-5028	medium	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.38.0	0.55.0	View
golang.org/x/net	GO-2026-5025	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.38.0	0.55.0	View
golang.org/x/net	CVE-2026-25681	medium	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.38.0	-	View
golang.org/x/net	CVE-2026-42506	medium	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.38.0	-	View
golang.org/x/net	GO-2026-5030	medium	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.38.0	0.55.0	View
golang.org/x/net	GO-2026-5027	medium	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.38.0	0.55.0	View
golang.org/x/net	GHSA-w4gw-w5jq-g9jh	MODERATE	golang.org/x/net/html has a Quadratic Parsing Complexity issue	v0.38.0	-	View
golang.org/x/net	GHSA-5cv4-jp36-h3mw	MODERATE	Go Net HTML parser is vulnerable to denial of service	v0.38.0	0.55.0	View
golang.org/x/net	GO-2026-4440	MODERATE	Quadratic parsing complexity in golang.org/x/net/html	v0.38.0	0.45.0	View
golang.org/x/mod	GO-2026-6180	unknown	Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb	v0.25.0	0.40.0	-
golang.org/x/mod	GO-2026-6179	unknown	Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog	v0.25.0	0.40.0	-
golang.org/x/net	GO-2026-4441	unknown	Infinite parsing loop in golang.org/x/net	v0.38.0	0.45.0	View
golang.org/x/net	GO-2026-5942	unknown	Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage	v0.38.0	0.56.0	View
golang.org/x/sys	GO-2026-5024	unknown	Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows	v0.39.0	0.44.0	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.25.0	0.39.0	-

---

Pausing automation
Set the case status to Blocked in Case Management to pause ADMS automation for this dependency. ADMS will skip updating it in the manifest while its case is Blocked — other dependencies in this PR (or future PRs) are unaffected. ADMS never changes a Blocked case's status automatically; move it back to Open (or another active status) yourself when you're ready to resume. See the case link in the table above.

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-datadog-us1-prod]

✨ Unblock PR with BitsAI

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 7 Pipeline jobs failed

DataDog/extendeddaemonset | Service catalog metadata validation — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

DataDog/extendeddaemonset | build — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

validation | build — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

View all 7 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 2ac02ac | Docs | View more details | Give us feedback!}

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto 99fedc2.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[cit-pr-commenter-54b7da]

Service catalog file validation

Service catalog validation failed — this check is advisory and does not block merges.

Validation failures:

• service.datadog.yaml
  • Unexpected error checking if there are duplicate files service named: extendeddaemonset): child workflow execution error (type: servicecatalog.ServiceCatalog_ValidateDuplicateServiceMetadata, workflowID: 01a0af06-1775-707a-9f00-602ca3ffde03_20, runID: 01a0af06-18fc-7d4f-84da-5966f053a61f, initiatedEventID: 20, startedEventID: 21): the GitHub owner in service definition URL "https://github.com/ManuelPalenzuelaDD/extendeddaemonset/blob/main/service.datadog.yaml" is "ManuelPalenzuelaDD", only repos under owners [DataDog ddoghq] are supported

How to solve it? Click here for details.
How to run the validation locally? Click here for details.
Any questions? Reach out to #sre-core-observability.