claude
353b8f5a16
govulncheck found 20 reachable advisories on 2026-08-10: 19 in the standard library and one in x/text. Go 1.25.12 closes the 19. The reachable traces that mattered are mavweb's HTML template escaping and the mavgpud proxy's TLS, both of which face the LAN. deps/ is gitignored and make deps-go builds the toolchain, so the bump is the version, its checksum and the go directive. Nothing is vendored by this commit. x/text stays at 0.14.0 (owner's call, 2026-08-11). Its one advisory is reached only through the ONNX embedder normalizing his own text, so nothing hostile arrives there, and 0.39.0 regenerates the Unicode tables for 41,385 changed lines against a 300-line pre-commit cap that exempts only markdown. The bump is worth doing when vendor/ is exempt from the guard, not before. No govulncheck make target either: it would fail on the x/text finding from the day it landed, and a gate that is red on arrival teaches people to skip it. make fmt-check, make vet, make build and make test pass on 1.25.12, 65 packages ok. The four TestONNX measurements pass in 29.6s.