fix(snyk): remediate high-and-above vulnerabilities blocking chore/bump-cli-extension-cos

[prodsec-github-automation]

Snyk agentic fix

The Snyk Open Source quality gate blocked chore/bump-cli-extension-cos. This branch was produced by snyk fix --agentic, working on vulnerabilities at or above high severity — the same threshold that gate is configured with.

0 of 6 fixed.

These changes are generated. Review them as you would any dependency bump — check the changelogs of the upgraded packages before merging.

Not fixed

Severity	Vulnerability	Where	Fix available	Breaking-change risk
High	Denial of Service (DoS)	cliv2-private/go.mod, cliv2/go.mod	Yes	Low — This is a patch version upgrade. Patch releases for the Deno standard library are intended to be backward-compatible, typically containing only bug fixes or security patches. No specific breaking changes are documented for this version range. The risk of introducing a breaking change in a patch release is minimal. Source: Package documentation
High	Uncontrolled Recursion	cliv2-private/go.mod, cliv2/go.mod	Yes	Medium — This is a patch version upgrade that includes a security fix for the encoding/asn1 package. - Behavioral Change: A recursion limit has been added to the Unmarshal function to prevent stack exhaustion when parsing deeply-nested structures. - Impact: This change addresses security vulnerability CVE-2026-33818. While it prevents a potential denial-of-service attack, it could theoretically cause parsing to fail for legitimate, but exceptionally deep, ASN.1 structures that were previously accepted. This new failure mode warrants verification if your application handles complex, deeply-nested ASN.1 data. Source: Go 1.26.6 Release Announcement
High	Uncontrolled Recursion	cliv2-private/go.mod, cliv2/go.mod	Yes	Medium — This is a patch version upgrade for the legacy Deno Standard Library (std). While patch releases are typically for non-breaking bug fixes, specific release notes or a detailed changelog for the transition from version 1.26.5 to 1.26.6 could not be located. Due to the absence of documentation, the exact changes are unknown. The risk is assessed as medium because of this uncertainty. Recommendation: Verify that XML parsing and serialization functionality behaves as expected after the upgrade.
High	Uncaught Exception	cliv2-private/go.mod, cliv2/go.mod	Yes	Low — This is a patch version upgrade for the Deno standard library's net module. Patch releases are intended for bug fixes and should not contain breaking changes. While specific release notes for this exact version were not found, it is unlikely to introduce any breaking changes based on semantic versioning principles. Recommendation: No action is expected to be required, but as with any upgrade, running a test suite is recommended to ensure no regressions have occurred.
High	Denial of Service (DoS)	cliv2-private/go.mod, cliv2/go.mod	Yes	Medium — This is a patch version upgrade. However, no specific release notes or changelog could be found for the std/net/http package in the version range 1.26.5 to 1.26.6. The versioning scheme does not align with the standard Deno library releases, which are typically prefixed with 0.x. Due to the lack of available information for this specific version range, the risk is assessed as medium out of an abundance of caution. Recommendation: Verify the source and correct versioning of this package. If this is a valid upgrade, manual testing is recommended to ensure no unexpected regressions were introduced.
High	Denial of Service (DoS)	cliv2-private/go.mod, cliv2/go.mod	Yes	Low — This is a patch version upgrade for Go's standard library net/url package. The go1.26.6 release includes security and bug fixes for the net/url package. [2, 5] No breaking API changes are documented for this minor point update. Source: The Go Programming Language Release History

A row marked Fix available: No has no upgrade path for snyk fix to take. One marked Yes does, but needed a change the agent would not make unattended — those are the rows to look at first.

This is not necessarily a complete fix. The build on this pull request runs the same quality gate that blocked chore/bump-cli-extension-cos, so its result — not this description — is the verdict on what is left.

Changes

 cliv2-private/go.mod | 2 +-
 cliv2/go.mod         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

_{Snyk ProdSec orb · build 637142 · model claude-opus-4-8}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 4 relevant code sections from 4 files (average relevance: 0.93) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) cliv2/cmd/gomodsync/main.go (lines 1-76) CLAUDE.md (lines 1-94) package-lock.json (lines 19745-19957)

🤖 Repository instructions applied (from AGENTS.md)