[deps] Update golang.org/x/vuln from v1.5.0 to v1.6.0

[github-actions]

Dependency Update: golang.org/x/vuln

Field	Value
Package	golang.org/x/vuln
Current	v1.5.0
Proposed	v1.6.0
Update Type	Minor version bump

Why a Separate Issue

This is a minor version update (v1.5.0 → v1.6.0) to a security-critical package (govulncheck). Minor updates may include behavior changes in vulnerability detection logic, new vulnerability checks, or changes to output format that could affect CI integrations.

Safety Assessment

⚠️ Minor version update to a security scanning tool. Requires review to ensure:

• No changes to vulnerability report format that could break parsing
• No new false positives introduced in CI checks
• govulncheck output is still compatible with downstream consumers

Links

• Repository: (go.googlesource.com/redacted)
• Commit history: (go.googlesource.com/redacted)
• pkg.go.dev: https://pkg.go.dev/golang.org/x/vuln

Update Command

go get golang.org/x/vuln@v1.6.0
go mod tidy

Test Notes

Run make test and verify that govulncheck invocations in the codebase still work as expected.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🔧 Dependabot Dependency Checker · 82.7 AIC · ⌖ 7.24 AIC · ⊞ 4.9K · ◷

• expires on Jul 12, 2026, 2:38 AM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · 3.29 AIC · ⌖ 11.7 AIC · ⊞ 8.4K · ◷