[scality-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/mod	v0.39.0 → v0.40.0

---

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

BIT-golang-2026-56865 / CVE-2026-56865 / GO-2026-6179

More information

Details

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

Unknown

References

• https://go.dev/issue/80744
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/814960
• https://go.dev/cl/815020

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

BIT-golang-2026-56864 / CVE-2026-56864 / GO-2026-6180

More information

Details

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.

This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

Unknown

References

• https://go.dev/issue/80745
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/815000
• https://go.dev/cl/815020

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: golang.org/x/mod v0.39.0 → v0.40.0 (minor)

Changes:

• Fixes CVE-2026-56865 (GO-2026-6179): Transparency log tile verification bypass — a malicious GOPROXY could forge sumdb tiles to serve attacker-controlled module content
• Fixes CVE-2026-56864 (GO-2026-6180): Unauthenticated hashes in sumdb Lookup — a coordinating GOPROXY and GOSUMDB could serve arbitrary unverified module content

Breaking changes: None

Security concerns: This update fixes two supply-chain security vulnerabilities. Both CVEs relate to Go module checksum database verification (sumdb/tlog and sumdb packages). The fixes ensure all tiles are correctly verified against their parents and unauthenticated hashes are rejected.

Impact on codebase: golang.org/x/mod is an indirect dependency — no Go source files in this repository import it directly. The module is pulled in transitively and only go.mod and go.sum are changed. There is zero risk of behavioral changes to this project's code.

CI status: detect-modules ✅ build-e2e ✅ — golangci-lint and tests were still running at time of review.

Recommendation: SAFE TO MERGE

Notes: Security update for an indirect dependency. The vulnerabilities affect Go's module proxy trust model, not application-level code. Merging promptly is recommended to keep the dependency chain patched against supply-chain attacks.

— Claude Code