fix(security/UNKNOWN/tools): Update module golang.org/x/mod to v0.40.0 [SECURITY]

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/mod	v0.37.0 → v0.40.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

CVE-2026-56865 / GO-2026-6179

More information

Details

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

Unknown

References

• https://go.dev/issue/80744
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/814960
• https://go.dev/cl/815020

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

CVE-2026-56864 / GO-2026-6180

More information

Details

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.

This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

Unknown

References

• https://go.dev/issue/80745
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/815000
• https://go.dev/cl/815020

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[github-actions]

🔍 Dependency Review

golang.org/x/mod v0.37.0 -> v0.40.0 — ✅ Safe

Summary

• No code changes required. Reviewing tags and release notes between v0.37.0 and v0.40.0 did not reveal breaking API changes to the public packages typically used (module, modfile, semver, zip, sumdb).
• Changes appear limited to internal fixes and minor enhancements. No removals or signature changes to exported functions or types were noted.

Evidence

• GitHub Releases / Tags:
  • v0.38.0: https://github.com/golang/mod/releases/tag/v0.38.0
  • v0.39.0: https://github.com/golang/mod/releases/tag/v0.39.0
  • v0.40.0: https://github.com/golang/mod/releases/tag/v0.40.0
• Diffs:
  • v0.37.0..v0.38.0: golang/mod@v0.37.0...v0.38.0
  • v0.38.0..v0.39.0: golang/mod@v0.38.0...v0.39.0
  • v0.39.0..v0.40.0: golang/mod@v0.39.0...v0.40.0

Potential areas to sanity-check (no changes required unless you rely on stricter behavior)

• If you rely on precise version validation or path checking, run your test suite to confirm no behavior changes in semver or module validation impact edge cases.

Required code changes

• None.

Suggested verification

• Run your tool build/tests to confirm:

  go get golang.org/x/mod@v0.40.0
  go build ./...
  go test ./...
  

Notes

• Only golang.org/x/mod changed in this PR. No new dependencies were added.