Fix 2 issues flagged across 2 files

[begininvoke]

A scan flagged a few things in this repository. This changes 2 files — one item each, described below.

1. go.mod, around line 1

The golang.org/x/text package contains a vulnerability in its norm.Iter implementation that triggers an infinite loop when processing input containing invalid UTF-8 bytes. This results in a high-severity Denial of Service (DoS), causing application thread hangs and excessive CPU consumption. Immediate dependency upgrade to the patched version is required.

Updates golang.org/x/text from v0.38.0 to v0.39.0 to address CVE‑2026‑56852, preserving the existing API and ensuring the go.mod file parses correctly.

For reference: rule CVE-2026-56852. Rated high.

2. reprolang/go.mod, around line 1

This HIGH severity vulnerability in golang.org/x/mod v0.33.0 allows a coordinated attack via GOPROXY and GOSUMDB to serve malicious module content that bypasses transparency log verification. Exploitation enables undetectable supply chain poisoning, potentially leading to arbitrary code execution or data compromise. Immediate update is required.

Update golang.org/x/mod from v0.33.0 to v0.40.0 to resolve CVE-2026-56864 and CVE-2026-56865.

For reference: rule CVE-2026-56864. Rated high.

I do not know the codebase, so please check the change fits how the rest of it works. Happy to adjust it or close this if the reasoning is off.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

[jupblb]

Oh no, reprolang is compromised. What a tragedy. And the go indexer could maybe get stuck in an infinite loop? No way.