[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/net	v0.60.0 → v0.62.0

---

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

CVE-2026-78661 / GO-2026-6860

More information

Details

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies.

Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

Severity

Unknown

References

• https://go.dev/cl/849365
• https://go.dev/issue/82224
• https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

CVE-2026-97045 / GO-2026-6866

More information

Details

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.

Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

Severity

Unknown

References

• https://go.dev/cl/855121
• https://go.dev/issue/82622
• https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: apps/backend/servicediscovery/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
golang.org/x/sys	v0.48.0 -> v0.49.0
golang.org/x/text	v0.42.0 -> v0.43.0

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: jdwlabs/apps
• Branch: main
• File: .coderabbit.yaml
• Commit: d1574be
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 100567cc-236e-4b41-89db-f1f64b804f60

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jdwlabs-review-bot]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Dependency Update The PR updates the golang.org/x/net module from v0.60.0 to v0.62.0, which includes a fix for CVE-2026-78661 related to quadratic complexity when coalescing text nodes in HTML parsing. This update addresses potential performance degradation under specific input conditions and improves the stability of HTML processing within the application. golang.org/x/net v0.62.0 // indirect golang.org/x/sys v0.49.0 // indirect golang.org/x/text v0.43.0 // indirect

[jdwlabs-review-bot]

PR Code Suggestions ✨

No code suggestions found for the PR.

[jdwillmsen]

merge-captain review: approve (tier R1, lane claude-sonnet, implementer unknown, 0 findings)

[jdwillmsen]

merge-captain: A code owner's review is required for the changed paths, so the approval is left for a person.

Deciding rules:

• lockfiles (apps/backend/servicediscovery/go.sum)
• manifests (apps/backend/servicediscovery/go.mod)