[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-5cv4-jp36-h3mw	GHSA-5cv4-jp36-h3mw	None	None	see lockfile		confirmed

Not Included

• Deferred by batch limit: 4 advisories. They will be considered by future runs.
• Other deferred scanner findings: 0.
• Unconfirmed attempted fixes: 0.

---

Note

Medium Risk
Raises the minimum Go toolchain version and bumps indirect networking/stdlib-related dependencies; low application logic risk but CI and build images must support Go 1.25.

Overview
Security-focused dependency refresh with no application code changes—only go.mod and go.sum.

The module now requires Go 1.25.0 (was 1.24.0). Indirect golang.org/x modules are bumped, notably golang.org/x/net to v0.55.0 and golang.org/x/sys to v0.45.0, with matching checksum updates for related transitive packages (e.g. x/crypto, x/term, x/text). This aligns with the Socket remediation workflow for GHSA-5cv4-jp36-h3mw.

Reviewers should confirm CI and local builds use Go 1.25+; runtime behavior should be unchanged aside from patched library versions pulled in through existing indirect deps (e.g. container/Docker tooling).

^{Reviewed by Cursor Bugbot for commit 176b6c6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ulziibay-kernel]

Diff is go.mod/go.sum only: x/net to v0.55.0 (GHSA-5cv4-jp36-h3mw) and x/sys to v0.45.0, with the toolchain raised from go 1.24.0 to 1.25.0. No source changes; CI builds and passes on 1.25. Approving.