Possible fix(deps): 2 vulnerable dependencies in go.mod

[begininvoke]

I think there may be a problem in hack/chart-update/go.mod around line 1.

CVE‑2026‑46600 in golang.org/x/net <0.56.0 allows an integer overflow when parsing a malicious SVCB or HTTPS DNS resource record, causing the parser to panic and crash the process. This results in a denial‑of‑service condition that can be triggered by crafted DNS responses, making it a high‑risk issue for any service that resolves DNS records using the net/dns package.

Something like this might fix it:

--- a/hack/chart-update/go.mod
+++ b/hack/chart-update/go.mod
@@ -1 +1 @@
-golang.org/x/net v0.55.0
+golang.org/x/net v0.56.0

For reference: rule CVE-2026-46600. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

[kubernetes-prow]

This issue is currently awaiting triage.

If CAPI Operator contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.