Bump Go 1.25.13 + x/text 0.39.0 to fix CVEs (release-0.9 backport)

[ibolton336]

What

Backports the stdlib + golang.org/x/text CVE fixes from #873 to the release-0.9 stream.

Why

Per the shipped-image build metadata, MTA 8.1 builds mta-cli-rhel9 from migtools/mta-kantra release-0.9 (doozer group mta-8.1). The batch-1/#873 fixes landed on main and were backported to release-0.10 (#876 = the 8.2 stream), but release-0.9 was still on go 1.25.0 / x/text 0.38.0 and had not received them.

Changes

• go directive 1.25.0 → 1.25.13 — fixes the stdlib CVEs: net/url (CVE-2026-56860), net/http (CVE-2026-56853), html/template (CVE-2026-56858), crypto/tls (CVE-2026-56862), encoding/xml (CVE-2026-56859), encoding/asn1 (CVE-2026-33818).
• golang.org/x/text 0.38.0 → 0.39.0 — CVE-2026-56852.
• go build ./... passes. go.mod/go.sum only.

Note: golang.org/x/net is already at v0.56.0 on release-0.9, so CVE-2026-42502 is already fixed on this stream. kin-openapi (CVE-2026-73501) is a separate backport (needs a code port for the older Schema.Type API on this branch).

Trackers (MTA 8.1)

MTA-7501 (x/text), MTA-7542 (net/url), MTA-7547 (net/http), MTA-7551 (html/template), MTA-7557 (crypto/tls), MTA-7544 (encoding/xml), MTA-7558 (encoding/asn1).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 98392e2c-9636-45cc-802c-27e1379f5036

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.56%. Comparing base (82226c6) to head (70b1d55).
⚠️ Report is 3 commits behind head on release-0.9.

Additional details and impacted files

@@             Coverage Diff              @@
##           release-0.9     #877   +/-   ##
============================================
  Coverage        46.56%   46.56%           
============================================
  Files               38       38           
  Lines             5360     5360           
============================================
  Hits              2496     2496           
  Misses            2534     2534           
  Partials           330      330           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.