fix(deps): Update module golang.org/x/net to v0.51.0 [SECURITY]

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/net	v0.50.0 → v0.51.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

CVE-2026-27141 / GO-2026-4559

More information

Details

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

Severity

Unknown

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-27141
• https://go.dev/cl/746180
• https://go.dev/issue/77652

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[github-actions]

🔍 Dependency Review

golang.org/x/net v0.50.0 -> v0.51.0 — ✅ Safe

• Summary

  • Reviewed changes between v0.50.0 and v0.51.0 for golang.org/x/net across commonly used subpackages (http2, proxy, publicsuffix, idna, netutil, html/charset, ipv4/ipv6).
  • No breaking API changes or removals were introduced in this range.
  • Updates are bug fixes, internal hardening, and data updates (e.g., tables used by idna/publicsuffix), which do not require caller code changes.

• Impact

  • No code changes are required to adopt v0.51.0.
  • Behavior-impacting changes were not documented for exported APIs in this bump.

• What to double-check (non-breaking but worth awareness)

  • If you consume x/net/http2 directly, keep an eye out for stricter validation that could surface previously-lenient cases as errors in logs (e.g., malformed headers). No API changes are needed; just address any new warnings if they appear.
  • If you rely on domain parsing via publicsuffix or idna, table updates can change classification outcomes for newly added or updated TLD rules—generally desired and non-breaking.

• Code changes: None required.

• References

  • golang.org/x/net release notes and commits between v0.50.0 and v0.51.0 indicate bugfixes and internal updates only; no exported API changes requiring adoption work.

Notes

• This bump occurs in three modules in the repo (root, collector, extension/alloyengine) and keeps them aligned on the same x/net version.
• No net-new dependencies were introduced.