deps: bump golang.org/x/text to v0.39.0 (CVE-2026-56852)

[bitcoin-coder-bob]

Trivy started failing on every open PR with CVE-2026-56852 (HIGH): a norm.Iter
in golang.org/x/text can enter an infinite loop on malformed input. Fixed in
v0.39.0.

The advisory landed after master's last scan, so master is affected too and will
go red on its next push. golang.org/x/text is an indirect dependency in 7 of
the 9 modules, so all 7 move together to keep check-go-sync happy.

The Docker image that Trivy scans builds two binaries, arkd from the root
module and ark from pkg/ark-cli, which is why the scan reported the finding
twice.

Transitive bumps

golang.org/x/text v0.39.0 requires x/tools v0.47.0, x/mod v0.37.0 and
x/sync v0.21.0 in its own go.mod, which in turn pull up x/crypto v0.53.0,
x/net v0.56.0, x/sys v0.46.0 and x/term v0.44.0 in the root module. That is
minimal version selection, not a deliberate widening of scope. No code changes,
only go.mod and go.sum.

Verification

• All 9 modules build.
• go vet ./... clean.
• make lint reports 0 issues.
• go test ./internal/core/... passes, plus pkg/ark-lib, pkg/errors,
  pkg/macaroons and pkg/kvdb.
• go mod tidy is idempotent, so check-go-sync passes.

The container-backed suite was not run, since nothing but dependency versions
changed.

Note on overlap

This same commit is already cherry-picked onto #1160, #1161, #1162 and #1163 so
those PRs are not blocked waiting on this one. Whichever lands first will make
the others conflict on go.sum. Resolve with git rebase master followed by
go mod tidy rather than hand-merging the hash lines.

Summary by CodeRabbit

• Chores
  • Updated indirect Go module dependencies across the project and related packages.
  • Includes refreshed security, networking, synchronization, terminal, text-processing, and development tooling components.
  • No user-facing features or public APIs changed.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 330c84bd-6d82-466a-9847-ac6da8722fab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Changes

The root and six nested Go modules update indirect golang.org/x/* dependency versions. Selected existing versions remain unchanged, including x/time, x/exp, x/sys, and x/term where specified.

Dependency version alignment

Layer / File(s)	Summary
Update indirect module requirements go.mod, api-spec/go.mod, pkg/*/go.mod	Indirect golang.org/x/* requirements are bumped across the module manifests, including x/sync, x/text, x/crypto, x/mod, x/net, x/sys, x/term, and x/tools.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: altafan

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: bumping golang.org/x/text to v0.39.0 for the CVE fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bob/bump-x-text-cve

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[bitcoin-coder-bob]

@arkana-ai-bot @coderabbitai review

[arkana-ai-bot]

I hit my usage limit before I could answer this. Re-ping me in a bit and I'll pick it up.

[coderabbitai]

@bitcoin-coder-bob: I’ll review the dependency update and its module consistency.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[arkana-ai-bot]

I hit my usage limit before I could answer this. Re-ping me in a bit and I'll pick it up.

[arkana-ai-bot]

I hit my usage limit before I could answer this. Re-ping me in a bit and I'll pick it up.

[arkana-ai-bot]

Dependency-only bump — no code, no protocol surface. Verified:

• Diff is exclusively go.mod/go.sum across 7 modules; no Go source, no proto, no config.
• The golang.org/x/text v0.39.0 hash (h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=, mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=) is byte-identical in all 7 go.sum entries — no per-module supply-chain skew.
• Transitive fan-out (x/tools v0.47, x/mod v0.37, x/sync v0.21) reaches every module that already depended on those, matching what x/text v0.39.0's own go.mod requires. The extra bumps to x/crypto v0.53 / x/net v0.56 / x/sys v0.46 / x/term v0.44 only show up in the modules whose other transitive deps force MVS to pick them (root, pkg/kvdb, pkg/macaroons); api-spec, pkg/ark-cli, pkg/arkd-wallet, pkg/client-lib correctly keep the older ones. That asymmetry is expected go mod tidy output, not an oversight.
• Root go.mod continues to require x/net v0.56 and x/crypto v0.53 directly (not // indirect), preserving the existing require-graph shape.

Nothing to flag. check-go-sync and the build-time verifications the description lists are the right gates; nothing in this diff can regress protocol behaviour on its own. Cannot independently verify the CVE-2026-56852 advisory content from this environment, but the fixed-version claim is consistent with x/text's own module manifest (evidenced by the transitive bumps landing exactly as x/text v0.39.0's go.mod requires).

Minor note, not blocking: leaving pkg/ark-cli, pkg/arkd-wallet, pkg/client-lib, api-spec on the older x/crypto/x/net/x/sys/x/term while root/kvdb/macaroons move forward is technically fine but means future Trivy findings in those packages would still bite the sub-modules. If a follow-up unifies the graph, doing it as a separate PR keeps this one minimal and easy to cherry-pick, which is what the description already optimises for.