build(deps): Bump golang.org/x/net from 0.58.0 to 0.59.0

[dependabot]

Bumps golang.org/x/net from 0.58.0 to 0.59.0.

Commits

• 540d04c go.mod: update golang.org/x dependencies
• 20eef7f quic: clear fast-path receive buffer on stream reset
• c23af1b internal/http3: fix compilation error due to missed symbol name update
• eda109f internal/http3: send appropriate error codes in STOP_SENDING frames
• 12e0501 internal/http3: server header size limits
• d89285e quic: add Stream.StopSending, and rework stream/application errors
• d34deae quic: ensure Endpoint.Close waits for connection loops to exit
• 55577aa http2: use IDNA Lookup profile, not raw Punycode translation
• b22627e internal/http3: handle a nil TLSConfig in newQUICConfig
• 6e98b0d internal/http3: report endpoint creation errors from initEndpoint
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 47c736f6-0db9-424a-8c40-1145bee18e97

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Hygiene

State: waiting-bots · commit d3bfe259314eb03d92f0cc0d339b2824b84d07e6

• thepastaclaw has not reported for the current head

Self-review is an author attestation that you have read the diff:
/self-reviewed — covers everything pushed so far; post it again after a new push.
Post it after this report appears for commit d3bfe259314eb03d92f0cc0d339b2824b84d07e6, or name the commit explicitly with /self-reviewed d3bfe259314eb03d92f0cc0d339b2824b84d07e6.

This report does not bypass CI or repository protection rules.

[github-actions]

@thepastaclaw review

No review for af2cdabb yet, so PR Hygiene is asking once. If nothing arrives, the requirement is dropped for this commit and the pull request is labelled bot-review-missed.

[thepastaclaw]

✅ Final review complete — no blockers (commit af2cdab) · triage: low · Phase 2 only (queue backlog)

[thepastaclaw]

Final validation — Phase 2 only (queue backlog)

The diff changes only go.mod and go.sum, updating golang.org/x/net and four companion modules with corresponding checksum entries; no concrete in-scope defect was identified. git diff --check passed. Focused Makefile tests for RPC, P2P connections, private validators, and secp256k1 stopped during dependency resolution because updated modules were not cached and network downloads were disabled, so runtime compatibility remains unverified.

Review provenance

Source: reviewer 1: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 2: gpt-6-astra (agent: phase2-reviewer, role: tenderdash-consensus-security); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: low by gpt-6-astra (effort low) — The diff is a small, contained dependency update limited to go.mod and go.sum, requiring version and compatibility checks but changing no application logic or critical surface directly.
• Phase 1 reviewers: not run (skipped for throughput: 12 PRs queued, above the 10 limit)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort medium); agent phase2-reviewer, gpt-6-astra — tenderdash-consensus-security (completed, effort medium); agent phase2-reviewer

[Claudius-Maginificent]

Dependency security review — golang.org/x/net 0.58.0 → 0.59.0

Verdict: ✅ SAFE to merge. No blocking findings.

Scope actually bumped (5 modules, go.mod/go.sum only, no vendor dir)

Module	From → To	Code delta
golang.org/x/net	0.58.0 → 0.59.0	see below
golang.org/x/crypto	0.56.0 → 0.57.0	go.mod only, no source changes
golang.org/x/text	0.41.0 → 0.42.0	unicode/norm, unicode/bidi, idna export, japanese encoding
golang.org/x/term	0.45.0 → 0.46.0	terminal.go ReadLine
golang.org/x/mod	0.40.0 → 0.41.0	doc comments only

Integrity

• All 10 go.sum hashes (h1 + go.mod) match independent go mod download through proxy.golang.org with GOSUMDB=sum.golang.org verification; go mod verify → all modules verified.
• Proxy origin: x/net v0.59.0 = go.googlesource.com/net 540d04cf, x/text v0.42.0 = fafe4a06 (official tags).

Reachability (go list -deps of ./cmd/... ./node/...)

Linked x/net packages: http2, http2/hpack, http/httpguts, idna, internal/httpcommon, internal/httpsfv, internal/timeseries, netutil, trace, context (mostly via grpc). Tenderdash imports only x/net/netutil directly (unchanged).

Source diff review (reachable code)

• http2: bulk of the change is Deprecated: doc annotations pointing to net/http equivalents (http2.Server, ConfigureServer, Transport fields, ClientConn). databuffer.go/trace/histogram.go: min/max refactors, behavior-identical. authorityAddr now runs idna.Lookup.ToASCII only for non-ASCII hosts (stricter profile; on failure host kept as before) — hardening.
• internal/httpcommon (server request parsing): now rejects Host header ≠ :authority, multiple Host headers, and authority failing httpguts.ValidHostHeader — host-confusion/smuggling hardening. Only relevant to x/net's server path; tenderdash does not run http2.Server/h2c directly.
• h2c: doc-only (warns first request is fully buffered — use http.MaxBytesHandler). Not used by tenderdash.
• dns/dnsmessage, html, quic, internal/http3, webdav: not linked into tenderdash.
• x/text unicode/norm: fixes recomposition map key truncation (16-bit clipping → full 21-bit runes), starter-blocking tracking during composition, Hangul + combining-mark composition, and an invalid-char path that returned 0 progress (potential no-progress loop) now consumes the byte. Transform ErrShortSrc condition corrected; verified quickSpan with eof=true consumes the full input, so no new loop at EOF. Net: correctness/robustness improvements for IDNA/PRECIS normalization.
• x/text unicode/bidi: log.Panic → panic (no more stderr logging on assert). Neutral.
• x/term: ReadLine now returns data received together with a read error before surfacing the error — correctness fix, no security impact.
• Toolchain: x/net 0.59.0 requires Go ≥ 1.26; repo pins go 1.27.1 (go.mod, CI, Docker) — compatible. On go1.27 the x/net http2.Transport wraps net/http (transport_wrap.go, !http2legacy), unchanged by this bump.

Vulnerability research

OSV.dev / Go vuln DB queried for x/net, x/text, x/term, x/crypto: every 2026 advisory (e.g. GO-2026-5942 dnsmessage panic, GO-2026-5970 x/text infinite loop, GO-2026-6354/6355 x/crypto/ssh DoS) is fixed at or below the old versions — none affects 0.58.0 nor 0.59.0, none introduced. govulncheck CI green independently confirms.

Verification

• CI on head d3bfe25: build, go vet, golangci-lint, govulncheck, tests (00–05), e2e (dashcore, rotate), test_apps, test_abci_cli — all pass.
• Local build not reproduced (native dashbls headers absent on audit host); CI is the build/test evidence.

🍬 Tally: 0 critical · 0 high · 0 medium · 0 low. Clean.

_{🤖 Co-authored by Claudius the Magnificent AI Agent}