update: golang.org/x/net

[dongsupark]

Name: golang.org/x/net
CVEs: CVE-2024-45338
CVSSs: n/a
Action Needed: update to >= 0.33.0

Summary: x/net/html: non-linear parsing of case-insensitive content. Version v0.33.0 of golang.org/x/net fixes a vulnerability in the golang.org/x/net/html package which could cause a denial of service. An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

See also https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA.

Unfortunately for some reason dependabot is not able to automatically create an update PR for affected repos.

refmap.gentoo: TBD

[tormath1]

• Nebraska: build(deps): bump github.com/labstack/echo/v4 from 4.12.0 to 4.13.3 in /backend nebraska#887
• Mantle: mod: go get -u golang.org/x/net mantle#571
• azure-vhd-utils: mod: go get -u golang.org/x/net azure-vhd-utils#4
• lerobot: mod: go get -u golang.org/x/net lerobot#20
• locksmith: mod: go get -u golang.org/x/net locksmith#23 & app-admin/locksmith: pull golang.org/x/net update scripts#2558

[tormath1]

Closing this as the update has been done on affected repos.