Census approval: sec-deps-dos-bumps

Ruling census-ruling-sec-deps-dos-bumps. Every change below keeps the disposition it already has, so it needs an approval, not a decision.

Envelopes re-pinned: ..

Seal: 945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a → 945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a (unchanged; loaded after sec-host-imdsv2-module, re-chained 2026-10-24 when that merged as ef156d3).

Overlay: internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv, appended to internal/provision/testdata/plan14-root-reads-chain.tsv.

Branch context

Branch sec-deps-dos-bumps bumps three modules that govulncheck reports as reachable on main:

| module | main | branch | findings | |---|---|---|---| | golang.org/x/net | v0.56.0 | v0.60.0 | GO-2026-6603, -6610, -6611, -6612, -6617 (HTTP/2 server and transport DoS) | | golang.org/x/text | v0.38.0 | v0.42.0 | GO-2026-5970 (idna infinite loop, reached from the edge's TLS SNI handling) | | github.com/pion/stun/v3 | v3.0.1 | v3.1.5 | GO-2026-6163 (panic on a malformed XOR-MAPPED-ADDRESS, reached from the relay's TURN server) |

x/text lands at v0.42.0, not v0.39.0, because x/net v0.60.0 requires it. The same requirement moves x/crypto (v0.57.0), x/sys (v0.48.0), x/sync (v0.23.0), x/mod (v0.41.0) and x/tools (v0.49.0), and raises go.mod's go directive from 1.26 to 1.26.0. stun v3.1.5 moves pion/dtls/v3 to v3.1.4 and pion/transport/v4 to v4.0.2, and drops pion/transport/v3. pion/turn/v4 stays at v4.1.4.

The change is go.mod and go.sum only. No Go source file changes, so no read is added, removed or changed, no census unit's digest moves, and the legacy seal does not move. The only census effect is the envelope re-pin of . above. The record-write census (9B8) and claim routes are unchanged.

go.mod meets go-1.26.10-emudhra, which raises the same go directive to 1.26.10 and pins . in its own overlay. Whichever lands second takes 1.26.10 and re-pins . once more (rerun make census-propose with the same NAME).