chore(deps): bump golang.org/x/net from 0.53.0 to 0.55.0

[dependabot]

Bumps golang.org/x/net from 0.53.0 to 0.55.0.

Commits

• 7770ec4 go.mod: update golang.org/x dependencies
• 4ece7b6 html: escape greater-than symbol in doctype identifiers
• 08be507 html: improve Noah's Ark clause performance
• a8fb2fe html: properly render fostered elements in foreign content
• 0dc5b7a html: properly check namespace in "in body" any other end tag
• a452f3c html: ignore duplicate attributes during tokenization
• f865199 quic: fix appendMaxDataFrame erroneously accumulating sentLimit
• 210ed3c quic: establish a "happened-before" relationship between stream write and read
• ad8140e quic: fix buffer slicing when handling overlapping stream data
• 23ee2ef http2: avoid API changes when built with go1.27
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 3, 2026, 5:31 PM ET / 21:31 UTC.

Summary
Dependabot updates the indirect Go module golang.org/x/net from v0.53.0 to v0.55.0 in go.mod and go.sum.

Reproducibility: not applicable. this is a dependency bump rather than a reported runtime bug.

Review metrics: 2 noteworthy metrics.

• Dependency files touched: 2 files changed, 3 insertions, 3 deletions. The diff is constrained to the Go module requirement and checksum entries.
• Relevant checks: CI deps/lint/test/release-check, docker, CodeQL, and secret scanning succeeded. The existing workflow covers the dependency, build, smoke, and supply-chain surfaces touched by this PR.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• [P2] No repair work is needed; this PR is a normal dependency review and merge candidate.

Security
Cleared: The diff only changes the official Go module requirement and go.sum hashes for an existing indirect dependency, with CodeQL and secret scanning green.

Review details

Best possible solution:

Keep this PR open for package-integrity owner review and merge it if the green dependency, test, release, CodeQL, and secret-scan checks remain clean.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency bump rather than a reported runtime bug.

Is this the best way to solve the issue?

Yes; updating the module requirement and checksums is the narrow maintainable solution for this Go dependency bump, with CI already checking tidy, verify, govulncheck, tests, and release build.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against b705bb058270.

Label changes

Label changes:

• add P3: This is a routine dependency maintenance PR with a small, mergeable diff and green checks.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so the external-contributor real behavior proof gate does not apply.

Label justifications:

• P3: This is a routine dependency maintenance PR with a small, mergeable diff and green checks.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so the external-contributor real behavior proof gate does not apply.

Evidence reviewed

What I checked:

• Current main still has the old dependency: Current main at b705bb0 lists golang.org/x/net v0.53.0 as an indirect dependency, so the PR is not already implemented on main. (go.mod:45, b705bb058270)
• Diff is constrained to module metadata: The PR diff changes go.mod and go.sum only, replacing golang.org/x/net v0.53.0 with v0.55.0 and the corresponding checksums. (go.mod:45, 4e4ac2a2c6c9)
• Repository does not import x/net directly: Source search found golang.org/x/net only in go.mod and go.sum, with no direct package import sites in the repository code. (go.mod:45, b705bb058270)
• CI covers the relevant validation path: The CI workflow verifies modules, enforces go.mod/go.sum tidy state, runs govulncheck, vet, tests, CLI build/smoke, and release-check for pull requests. (.github/workflows/ci.yml:32, b705bb058270)
• GitHub checks are green and branch is mergeable: GitHub reports the PR as MERGEABLE, with CI deps/lint/test/release-check, docker, CodeQL, and secret scanning succeeded. (4e4ac2a2c6c9)
• No duplicate x/net item found: GitHub PR search for x/net and golang.org/x/net found only this open PR, and issue search found no matching issue.

Likely related people:

• @openclaw/openclaw-secops: CODEOWNERS explicitly assigns go.mod and go.sum, the two touched files, to this team. (role: CODEOWNERS package-integrity reviewer; confidence: high; commits: f5f549466731; files: .github/CODEOWNERS, go.mod, go.sum)
• Peter Steinberger: git blame ties the current go.mod dependency block and CODEOWNERS package-integrity rules to the v0.7.3 release-prep commit. (role: dependency surface introducer and recent release contributor; confidence: high; commits: f5f549466731; files: go.mod, go.sum, .github/CODEOWNERS)
• Vincent Koc: git log -S shows earlier go.mod/go.sum history involving golang.org/x/net traces in foundational and release-note commits, though the current line is not blamed to this author. (role: earlier module-history contributor; confidence: medium; commits: 588584e4ea53, d0de124f7549; files: go.mod, go.sum)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.