[kelvinprabhu]

Stacked on #119.

What

Updates golang.org/x/net to a version with known security issues fixed:

• golang.org/x/net: v0.60.0 → v0.62.0 (pulls x/crypto v0.58.0, x/sys v0.49.0, x/text v0.43.0, x/sync v0.24.0)

Why

The Security Scan check fails on #119 and every other branch: Trivy reports CVE-2026-78661 (HIGH) and CVE-2026-97045 (MEDIUM) in x/net v0.60.0. No app code changes.

Testing

make test-ci passes locally. Trivy scan to be confirmed by Security Scan on this PR.

Closes #129

[github-actions]

🛡️ Trivy security scan (CRITICAL,HIGH,MEDIUM,LOW)

View full run

Go dependencies

No findings at CRITICAL,HIGH,MEDIUM,LOW.

Container image

No findings at CRITICAL,HIGH,MEDIUM,LOW.

[github-actions]

📊 Test Coverage: ➖ Not applicable — no non-test Go files changed vs origin/fix/107-mandi-price-filter-the-response-to-the-requested-market-and-price-fields, so there are no lines to measure and no percentage to report.

[kelvinprabhu]

done

[manjudr]

Reviewed at f714ecb. The bump itself is clean -- I verified it rather than taking the description's word for it:

• every version is the current release on the module proxy (net v0.62.0, crypto v0.58.0, sys v0.49.0, text v0.43.0, sync v0.24.0)
• go mod tidy is a no-op on both files, so go.mod and go.sum agree
• go build ./... and go vet ./pkg/... are clean, and the MandiPrice suites pass
• Security Scan passes here and fails on #119, so it does what it says

One finding, and it is about where this lands, not what is in it.

---

1. A repo-wide security fix is queued behind a feature PR

Problem

The base of this PR is fix/107-mandi-price-filter-the-response-to-the-requested-market-and-price-fields, not development.

The description says the scan "fails on #119 and every other branch", and that is right -- development still carries golang.org/x/crypto v0.57.0 and golang.org/x/net v0.60.0. There are eight open PRs based on development, and every one of them has a red Security Scan that only this PR fixes. None of them can go green until #119 merges, and #119 is a feature PR with its own review cycle.

So the one change that unblocks the repo is the one that cannot land on its own.

Recommendation

Retarget this to development and merge it there. It touches go.mod and go.sum only, so it rebases onto development without conflict. Then rebase #119 on top and its scan goes green too.

Worth noting: because this targets a feature branch, Closes #129 will not fire on merge. Retargeting fixes that as well.

---

Approving the contents. Change the base and this is good to go.