fix: bump golang.org/x/mod to v0.40.0 for security advisories

[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-09-28.
Change type: Major version bump(s), manifest/lockfile only.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
golang.org/x/mod	Go	Major (0.x)	0.32.0 → 0.40.0	High	18d	Wiz	CVE-2026-56864
golang.org/x/mod	Go	Major (0.x)	0.32.0 → 0.40.0	High	18d	Wiz	CVE-2026-56865
golang.org/x/net	Go	Minor (transitive)	0.48.0 → 0.58.0	Medium	87d	Dependabot	GHSA-5cv4-jp36-h3mw / CVE-2026-25680

Deferred / excluded findings

• Deferred to open Dependabot PR chore(deps): bump the go_modules group across 1 directory with 2 updates #68 — github.com/antchfx/xpath 1.3.5 → 1.3.6 (High).
• grpc is in the separate devin/dep-vulns-minor/2026-09-28 PR.

Verification

• Install: ✅ go mod tidy (Go 1.25.7)
• Build: ✅ go build ./..., go vet ./...
• Tests: ✅ go test ./...
• Lint: ⚠️ golangci-lint v2.6.2 locally: 1 pre-existing govet buildtag finding in apis/generate.go (untouched)

Link to Devin session: https://app.devin.ai/sessions/cf588db3ed68460d87eaa49277057d90
Open in Devin Desktop: https://app.devin.ai/desktop/session/cf588db3ed68460d87eaa49277057d90?variant=devin

---

Note

Overview
Security dependency refresh with no application code changes—only go.mod and go.sum.

This PR bumps indirect golang.org/x modules to address reported advisories: golang.org/x/mod 0.32.0 → 0.40.0 (CVE-2026-56864, CVE-2026-56865) and golang.org/x/net 0.48.0 → 0.58.0 (CVE-2026-25680). go mod tidy also refreshed related transitive pins (golang.org/x/crypto, sync, sys, term, text, tools) in the lockfile.

Reviewers should treat this like any automated vuln fix: confirm build/tests in your environment before merge; grpc and other findings are handled in separate PRs per the description.

^{Reviewed by Cursor Bugbot for commit 2e9dee6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring