fix(deps): patch goldmark xss and x/mod sumdb advisories

[jahvon]

Summary

GitHub flags 7 open security alerts across Dependabot and code scanning. This PR fixes the three that are genuinely fixable. The other four are covered below with reasoning — two are false positives, one has no fix path, and one has no fix at all.

Fixed

Advisory	Severity	Module	From → To
GO-2026-5320	error	github.com/yuin/goldmark	1.7.13 → 1.7.17
GO-2026-6179	note	golang.org/x/mod	0.37.0 → 0.40.0
GO-2026-6180	note	golang.org/x/mod	0.37.0 → 0.40.0

GO-2026-5320 is the one that matters. It's the only alert where our code actually reaches the vulnerable symbols — Renderer.renderAutoLink, renderImage, renderLink in goldmark/renderer/html. The path is cmd/internal → tuikit/views → glamour → goldmark, so it's transitive through our own TUI stack rather than something we import directly.

The two x/mod advisories are sumdb integrity issues (tlog tile verification bypass; unauthenticated hash handling in Lookup). Not called by our code.

x/crypto, x/net, x/text, and x/tools move as a consequence of the x/mod bump.

Not fixed, with reasons

GO-2026-5932 — golang.org/x/crypto/openpgp unmaintained (note). This advisory has introduced: 0 and no fixed version — it announces that the package is unmaintained and unsafe by design. No bump can ever clear it; the only resolution is dropping the openpgp dependency, which arrives transitively. Our code doesn't call it. Bumping x/crypto to 0.55.0 here does not and cannot close this alert.

Dependabot #116 — vite server.fs.deny bypass on Windows (high). No supported fix path exists today:

• We're on vite 5.4.21. The fix landed in 6.4.3 — there is no patched 5.x.
• vitepress@1.6.4 is the latest stable and hard-requires vite ^5.4.14.
• vitepress 2.x is alpha-only (2.0.0-alpha.19).

Forcing vite 6 via overrides would pair vitepress 1.x with a vite major it doesn't support. I'd rather not do that silently one PR after the docs redesign (#453). Actual exposure is also low: it's a dev-server path-traversal on Windows, and the docs ship as a static build to Cloudflare Pages — the dev server never runs in production.

Code scanning #99 and #100 — go/allocation-size-overflow (high). Both are false positives:

internal/runner/exec/container.go:194   out := make(map[string]string, len(envMap)+1)
internal/services/run/container.go:109  flattenedFields := make([]interface{}, 0, len(logFields)*2)

These are len() of an in-memory map sized from the process's own environment and log fields. Overflowing would need a map with more than maxInt/2 entries. Adding bounds checks here would be defensive noise against an unreachable condition, so I've left the code alone. These are better resolved by dismissing the alerts as false positives — happy to do that if you agree, but it changes repo security state so I didn't do it unilaterally.

Testing

• govulncheck — goldmark, x/mod, and x/crypto no longer appear anywhere in the called or required sets. (Rebuilt govulncheck first; the installed one was compiled with go1.24 and couldn't parse the tree.)
• flow lint — 0 issues.
• flow test unit — pass.
• flow test e2e — pass.
• go build ./... clean.

The remaining 20 govulncheck findings are all standard library, from my local go1.26.0 toolchain and fixed in go1.26.1. They aren't repo issues and aren't what GitHub flagged — CI builds on 1.25.x.

Note on the go directive

go.mod declares go 1.25.8. GO-2026-6179/6180 also list the toolchain as affected, fixed in 1.25.13. Raising the directive would guarantee contributors build with a patched sumdb verifier, but it raises the minimum toolchain for everyone, so I've left it as a separate call for you.

🤖 Generated with Claude Code

https://claude.ai/code/session_012mnVfKRbSbYV43gdjcdxdX

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!