Security: upgrade bundled Go dependencies to remediate CVEs

Request

Please upgrade the bundled Go dependencies in lark-cli to remediate the CVEs listed below.

Affected release and evidence

• Latest checked release: v1.0.92 (2026-08-28)
• Affected artifact: lark-cli-1.0.92-linux-amd64.tar.gz
• go version -m reports:
  • golang.org/x/net v0.33.0
  • golang.org/x/image v0.30.0
  • golang.org/x/text v0.28.0

These versions were detected in Decidex vulnerability scan GALAXY-39266 on 2026-08-28. The scan also reported the affected component as lark-cli.

High severity CVEs

Medium severity CVEs

Requested action

Please upgrade to secure compatible versions, preferably at least:

• golang.org/x/net >= v0.56.0
• golang.org/x/image >= v0.43.0
• golang.org/x/text >= v0.39.0

After publishing a new release, we can verify the embedded module versions from the release binaries and rerun the Decidex scan.

Thank you!

Start by locating the Go dependency manifest and the lark-cli release build entry point. Upgrade the listed modules to secure compatible versions, build a new release, then use go version -m on the Linux archive to verify the embedded versions and rerun the Decidex scan.