[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/net	v0.60.0 → v0.62.0

---

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

CVE-2026-78661 / GO-2026-6860

More information

Details

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies.

Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

Severity

Unknown

References

• https://go.dev/cl/849365
• https://go.dev/issue/82224
• https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

CVE-2026-97045 / GO-2026-6866

More information

Details

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.

Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

Severity

Unknown

References

• https://go.dev/cl/855121
• https://go.dev/issue/82622
• https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone Asia/Taipei)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

go: downloading github.com/ehazlett/simplelog v0.0.0-20200226020431-d374894e92a4
go: downloading github.com/harvester/harvester v1.5.1
go: downloading github.com/rancher/wrangler/v3 v3.4.0
go: downloading github.com/rancher/wrangler v1.1.2
go: downloading github.com/sirupsen/logrus v1.9.4
go: downloading github.com/urfave/cli/v2 v2.3.0
go: downloading github.com/harvester/webhook v0.1.5
go: downloading k8s.io/client-go v0.35.0
go: downloading github.com/longhorn/longhorn-manager v1.11.0
go: downloading k8s.io/api v0.35.0
go: downloading k8s.io/apimachinery v0.35.0
go: downloading github.com/harvester/go-common v0.0.0-20260108124725-70d352e21314
go: downloading github.com/jaypipes/ghw v0.8.1-0.20210701154532-dd036bd38c40
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/stretchr/testify v1.11.1
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/rancher/lasso v0.2.6
go: downloading golang.org/x/sys v0.49.0
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/kevinburke/ssh_config v1.2.0
go: downloading github.com/melbahja/goph v1.3.0
go: downloading golang.org/x/sync v0.24.0
go: downloading github.com/cpuguy83/go-md2man/v2 v2.0.7
go: downloading github.com/gorilla/mux v1.8.1
go: downloading github.com/rancher/dynamiclistener v0.7.3
go: downloading k8s.io/apiextensions-apiserver v0.35.0
go: downloading github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
go: downloading golang.org/x/net v0.62.0
go: downloading k8s.io/klog/v2 v2.130.1
go: downloading k8s.io/utils v0.0.0-20260108192941-914a6e750570
go: downloading sigs.k8s.io/randfill v1.0.0
go: downloading k8s.io/kube-openapi v0.0.0-20260304202019-5b3e3fdb0acf
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.3.1
go: downloading github.com/prometheus/procfs v0.17.0
go: downloading github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d
go: downloading howett.net/plist v1.0.1
go: downloading golang.org/x/tools v0.51.0
go: downloading k8s.io/code-generator v0.35.0
go: downloading k8s.io/gengo v0.0.0-20250130153323-76c5745d3511
go: downloading k8s.io/gengo/v2 v2.0.0-20250922181213-ec3ebc5fd46b
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/google/gnostic-models v0.7.0
go: downloading google.golang.org/protobuf v1.36.11
go: downloading golang.org/x/time v0.14.0
go: downloading gopkg.in/evanphx/json-patch.v4 v4.13.0
go: downloading sigs.k8s.io/yaml v1.6.0
go: downloading github.com/evanphx/json-patch v5.9.11+incompatible
go: downloading github.com/pkg/sftp v1.13.4
go: downloading golang.org/x/crypto v0.58.0
go: downloading github.com/spf13/pflag v1.0.10
go: downloading golang.org/x/term v0.47.0
go: downloading github.com/russross/blackfriday/v2 v2.1.0
go: downloading github.com/fxamacker/cbor/v2 v2.9.0
go: downloading github.com/go-logr/logr v1.4.3
go: downloading golang.org/x/oauth2 v0.33.0
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
go: downloading github.com/json-iterator/go v1.1.12
go: downloading go.yaml.in/yaml/v2 v2.4.3
go: downloading github.com/go-ole/go-ole v1.3.0
go: downloading github.com/ghodss/yaml v1.0.0
go: downloading golang.org/x/text v0.43.0
go: downloading kubevirt.io/api v1.4.0
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading github.com/prometheus/client_golang v1.23.2
go: downloading github.com/kr/fs v0.1.0
go: downloading github.com/x448/float16 v0.8.4
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading golang.org/x/mod v0.41.0
go: downloading github.com/emicklei/go-restful/v3 v3.12.2
go: downloading github.com/go-openapi/jsonreference v0.21.0
go: downloading github.com/go-openapi/swag v0.23.0
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/prometheus/client_model v0.6.2
go: downloading github.com/prometheus/common v0.66.1
go: downloading github.com/google/go-cmp v0.7.0
go: downloading k8s.io/kube-aggregator v0.35.0
go: downloading github.com/go-openapi/jsonpointer v0.21.0
go: downloading github.com/mailru/easyjson v0.9.0
go: downloading github.com/josharian/intern v1.0.0
go: github.com/harvester/node-disk-manager/pkg/controller/blockdevice imports
	github.com/harvester/harvester/pkg/generated/controllers/harvesterhci.io/v1beta1 imports
	github.com/harvester/harvester/pkg/apis/harvesterhci.io/v1beta1 imports
	kubevirt.io/api/core/v1: kubevirt.io/api@v1.4.0: Get "https://proxy.golang.org/kubevirt.io/api/@v/v1.4.0.zip": read tcp 10.62.0.7:48670->142.251.179.141:443: read: connection reset by peer