fix(deps): update module golang.org/x/net to v0.23.0 [security] - autoclosed

[tradeshift-renovate]

This PR contains the following updates:

Package	Type	Update	Change
golang.org/x/net	require	minor	v0.17.0 -> v0.23.0

GitHub Vulnerability Alerts

CVE-2023-45288

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Copenhagen, Automerge - "every weekday in 2125" in timezone Europe/Copenhagen.

🚦 Automerge: Enabled.

♻️ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[tradeshift-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
golang.org/x/crypto	v0.14.0 -> v0.21.0
golang.org/x/sys	v0.13.0 -> v0.18.0
golang.org/x/text	v0.13.0 -> v0.14.0