govulncheck newly flags GO-2026-5970 (infinite loop on invalid input in golang.org/x/text < v0.39.0), causing every fresh backend-security CI run to fail. Upgrading x/text pulls sibling golang.org/x/* modules (crypto/mod/net/sync/sys/term/tools) to their matching minor versions.