[scality-renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
golang.org/x/text	v0.34.0 → v0.41.0

---

Infinite loop on invalid input in golang.org/x/text

CVE-2026-56852 / GO-2026-5970

More information

Details

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Severity

Unknown

References

• https://go.dev/issue/80142
• https://go.dev/cl/794100

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Panic parsing crafted input in x/text/secure/precis in golang.org/x/text

CVE-2026-56851 / GO-2026-6629

More information

Details

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Severity

Unknown

References

• https://go.dev/cl/793360
• https://go.dev/issue/80112

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Dependency Bump Evaluation

Version change: golang.org/x/text v0.34.0 → v0.41.0 (minor, spans 7 minor versions)
Semver bump type: minor

Changes:

• Security fix for CVE-2026-56852 (GO-2026-5970): norm.Iter infinite loop on invalid UTF-8 input (fixed in v0.39.0)
• Security fix for CVE-2026-56851 (GO-2026-6629): panic in secure/precis Nickname profile on crafted input (fixed in v0.41.0)

Breaking changes: None identified. The golang.org/x packages follow the Go compatibility promise.

Security concerns: Both CVEs are DoS-class vulnerabilities (infinite loop, panic). This update fixes them. No supply chain concerns — this is an official Go extended library maintained by the Go team.

Impact on codebase: Minimal. golang.org/x/text is an indirect dependency — no Go source files in this repo import it directly. It is pulled in transitively by other dependencies (likely go-pretty, go-runewidth, clipperhouse/uax29). The affected packages (unicode/norm, secure/precis) are not used anywhere in this codebase.

Recommendation: SAFE TO MERGE (once CI passes)

Notes:

• CI checks (golangci-lint, tests) were still in progress at evaluation time — verify they pass before merging
• PR authored by scality-renovate[bot] (not dependabot), so auto-approval is not applied per policy
• As a security update for an indirect dependency with no direct codebase impact, this is low-risk

— Claude Code