chore(deps): weekly safe go updates · 2 packages

[mendral-app]

Packages bumped

Package	Old	New	Type
github.com/cloudflare/circl	v1.6.4	v1.6.5	patch (indirect)
google.golang.org/protobuf	v1.36.11	v1.36.12	patch (indirect)

Per-package detail

github.com/cloudflare/circl v1.6.4 → v1.6.5

Changelog highlights (security hardening release, published 2026-08-05):

• Reject malformed/trailing data across cryptographic modules (Ascon, Dilithium, Ed25519/Ed448, BLS12381, FourQ, Goldilocks)
• HPKE/KEM: exact-length key unmarshaling
• BlindRSA: reject non-canonical signatures and messages not coprime with modulus
• Panic prevention: TSS/RSA out-of-bounds, HPKE empty buffer, OT/SimOT ciphertext mismatches
• BlindRSA PSSZERO now aligns with RFC 9474; constant-time improvements in FourQ arithmetic

Impact on this codebase: Indirect dependency via github.com/ProtonMail/go-crypto (used by go-git for SSH/GPG operations). The input validation hardening strengthens cryptographic operations in git transport. No API changes.

---

google.golang.org/protobuf v1.36.11 → v1.36.12

Changelog highlights (published 2026-08-10):

• Support for hex and octal default values in proto3 fields
• Fix google.protobuf.Empty serialization in protojson
• Added recursion limit in prototext encoding to prevent stack exhaustion
• Reject non-numeric integer/float values in protojson
• Error on size overflow in protodelim
• Performance: replace MethodByName calls with direct calls for Go 1.26 compatibility and DCE optimization

Impact on this codebase: Indirect dependency via cuelang.org/go (CUE uses protobuf for schema definitions). The recursion limit and validation hardening improve robustness. No API changes.

Files modified

• backend/go.mod
• backend/go.sum

Skipped this ecosystem

Package	Current	Candidate	Reason
cuelang.org/go	v0.17.0	v0.17.1	Open PR #3 already covers this bump
github.com/go-git/go-git/v5	v5.19.1	v5.19.2	Open PR #5 already covers this bump
github.com/gin-gonic/gin	v1.12.0	—	Already at latest stable
github.com/joho/godotenv	v1.5.1	v1.6.0-pre.4	Only pre-release available; skipped
golang.org/x/crypto	v0.54.0	v0.55.0	Published 2026-08-11, within cooldown
golang.org/x/net	v0.57.0	v0.58.0	Published 2026-08-12, within cooldown
golang.org/x/text	v0.40.0	v0.41.0	Published 2026-08-11, within cooldown
golang.org/x/sys	v0.47.0	—	Already at latest eligible
golang.org/x/sync	v0.22.0	—	Already at latest eligible
golang.org/x/oauth2	v0.36.0	—	Already at latest eligible

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session