chore(deps): update module golang.org/x/mod to v0.40.0 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/mod	v0.38.0 → v0.40.0

---

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

BIT-golang-2026-56865 / CVE-2026-56865 / GO-2026-6179

More information

Details

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

Unknown

References

• https://go.dev/issue/80744
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/814960
• https://go.dev/cl/815020

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

BIT-golang-2026-56864 / CVE-2026-56864 / GO-2026-6180

More information

Details

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.

This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

Unknown

References

• https://go.dev/issue/80745
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/815000
• https://go.dev/cl/815020

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
golang.org/x/tools	v0.48.0 -> v0.49.0

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7d9049b6-c63a-4ee1-961b-cb743dc8dee8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 38442984373

Coverage remained the same at 38.136%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	472
Covered Lines:	180
Line Coverage:	38.14%
Coverage Strength:	0.81 hits per line

---

💛 - Coveralls