govulncheck: 8 called vuln(s) detected

[github-actions]

govulncheck detected 8 called vulnerability/ies

Workflow run: https://github.com/nopperabbo/kiroxy/actions/runs/26326480108

Text report

=== Symbol Results ===

Vulnerability #1: GO-2026-5026
    Invoking failure to reject ASCII-only Punycode-encoded labels in
    golang.org/x/net/idna
  More info: https://pkg.go.dev/vuln/GO-2026-5026
  Module: golang.org/x/net
    Found in: golang.org/x/net@v0.52.0
    Fixed in: golang.org/x/net@v0.55.0
    Example traces found:
      #1: internal/tracing/transport.go:67:31: tracing.tracingTransport.RoundTrip calls http.Transport.RoundTrip, which eventually calls idna.ToASCII

Vulnerability #2: GO-2026-4918
    Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
    net/http/internal/http2 in golang.org/x/net
  More info: https://pkg.go.dev/vuln/GO-2026-4918
  Module: golang.org/x/net
    Found in: golang.org/x/net@v0.52.0
    Fixed in: golang.org/x/net@v0.53.0
    Example traces found:
      #1: internal/tracing/transport.go:67:31: tracing.tracingTransport.RoundTrip calls http.Transport.RoundTrip, which eventually calls http2.Transport.NewClientConn
      #2: internal/tracing/transport.go:67:31: tracing.tracingTransport.RoundTrip calls http.Transport.RoundTrip, which eventually calls http2.Transport.RoundTrip
      #3: internal/tracing/transport.go:67:31: tracing.tracingTransport.RoundTrip calls http.Transport.RoundTrip, which eventually calls http2.noDialH2RoundTripper.NewClientConn
      #4: internal/tracing/transport.go:67:31: tracing.tracingTransport.RoundTrip calls http.Transport.RoundTrip, which eventually calls http2.noDialH2RoundTripper.RoundTrip
      #5: internal/tracing/transport.go:67:31: tracing.tracingTransport.RoundTrip calls http.Transport.RoundTrip, which eventually calls http2.unencryptedTransport.RoundTrip

Your code is affected by 2 vulnerabilities from 1 module.
This scan also found 0 vulnerabilities in packages you import and 6
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.