[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/image	v0.23.0 → v0.41.0

---

Go Images vulnerable to an out-of-memory error via a crafted TIFF file

CVE-2026-33809 / GHSA-44p7-9xx4-hf2g

More information

Details

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-33809
• https://go.dev/cl/757660
• https://go.dev/issue/78267
• https://pkg.go.dev/vuln/GO-2026-4815
• https://github.com/advisories/GHSA-44p7-9xx4-hf2g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

CVE-2026-46599 / GHSA-q675-qj96-32m9

More information

Details

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-46599
• https://go.dev/cl/759960
• https://go.dev/issue/79577
• https://groups.google.com/g/golang-announce/c/uhYX90BlBvI
• https://pkg.go.dev/vuln/GO-2026-5032
• https://github.com/advisories/GHSA-q675-qj96-32m9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.24.0 -> 1.25.0

File name: vnet/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.24.0 -> 1.25.0
github.com/pion/rtp	v1.10.3 -> v1.10.4

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.42%. Comparing base (7ab8416) to head (3bd7a47).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #187   +/-   ##
=======================================
  Coverage   56.42%   56.42%           
=======================================
  Files          21       21           
  Lines        1884     1884           
=======================================
  Hits         1063     1063           
  Misses        821      821           

Flag	Coverage Δ
go	56.42% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.