# Census approval: sec-deps-dos-bumps

Ruling `census-ruling-sec-deps-dos-bumps`. Every change below keeps the disposition it already has, so it needs an approval, not a decision.

Envelopes re-pinned: `.`.

Seal: `945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a` → `945934f5978ace14dc5a9bae0ed69dfabf29b994504fc843c03d4a633ecd6c6a` (unchanged; loaded after sec-host-imdsv2-module, re-chained 2026-10-24 when that merged as ef156d3).

Overlay: `internal/provision/testdata/plan14-root-reads-sec-deps-dos-bumps.tsv`, appended to `internal/provision/testdata/plan14-root-reads-chain.tsv`.

## Branch context

Branch `sec-deps-dos-bumps` bumps three modules that govulncheck reports as
reachable on main:

| module | main | branch | findings |
|---|---|---|---|
| `golang.org/x/net` | v0.56.0 | v0.60.0 | GO-2026-6603, -6610, -6611, -6612, -6617 (HTTP/2 server and transport DoS) |
| `golang.org/x/text` | v0.38.0 | v0.42.0 | GO-2026-5970 (idna infinite loop, reached from the edge's TLS SNI handling) |
| `github.com/pion/stun/v3` | v3.0.1 | v3.1.5 | GO-2026-6163 (panic on a malformed XOR-MAPPED-ADDRESS, reached from the relay's TURN server) |

x/text lands at v0.42.0, not v0.39.0, because x/net v0.60.0 requires it. The
same requirement moves x/crypto (v0.57.0), x/sys (v0.48.0), x/sync (v0.23.0),
x/mod (v0.41.0) and x/tools (v0.49.0), and raises go.mod's `go` directive from
`1.26` to `1.26.0`. stun v3.1.5 moves pion/dtls/v3 to v3.1.4 and
pion/transport/v4 to v4.0.2, and drops pion/transport/v3. pion/turn/v4 stays at
v4.1.4.

The change is go.mod and go.sum only. No Go source file changes, so no read is
added, removed or changed, no census unit's digest moves, and the legacy seal
does not move. The only census effect is the envelope re-pin of `.` above.
The record-write census (9B8) and claim routes are unchanged.

go.mod meets `go-1.26.10-emudhra`, which raises the same `go` directive to
`1.26.10` and pins `.` in its own overlay. Whichever lands second takes
`1.26.10` and re-pins `.` once more (rerun `make census-propose` with the same
NAME).