chore: upgrade golang.org/x/text to v0.39.0 to address CVE-2026-56852

[brendan-kellam]

Fixes SOU-1751

Summary

• advance vendor/zoekt through sourcebot-dev/zoekt#19
• upgrade the bundled golang.org/x/text from v0.37.0 to the patched v0.39.0
• address CVE-2026-56852, where norm.Iter can enter an infinite loop on invalid UTF-8 input

The submodule advance also includes the intervening Zoekt workflow repair from sourcebot-dev/zoekt#18.

Verification

• go mod verify in vendor/zoekt
• go build -C vendor/zoekt -o /private/tmp/sourcebot-sou-1751-bin ./cmd/...
• git diff --check

---

Note

Low Risk
Dependency-only change in the Zoekt submodule with a targeted patch for a known CVE; risk is low assuming Zoekt builds and indexing behave as before.

Overview
Security dependency bump for the vendored Zoekt search engine: the vendor/zoekt submodule is advanced (including upstream Zoekt workflow fixes from sourcebot-dev/zoekt#18–#19), and golang.org/x/text is upgraded from v0.37.0 to v0.39.0.

This addresses CVE-2026-56852, where norm.Iter could hang in an infinite loop on invalid UTF-8 input. No application logic changes in the main monorepo beyond the submodule pointer and transitive Go module versions used when building Zoekt binaries.

^{Reviewed by Cursor Bugbot for commit e090f25. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Walkthrough

The PR updates the bundled Zoekt submodule and adds an Unreleased changelog entry for its golang.org/x/text dependency upgrade to v0.39.0.

Changes

Zoekt submodule update

Layer / File(s)	Summary
Update Zoekt reference vendor/zoekt, CHANGELOG.md	The Zoekt submodule advances to commit 05e6c4099ecaab884b66a21c97e419bd11f507a8. The changelog records the bundled golang.org/x/text upgrade to v0.39.0.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• sourcebot-dev/sourcebot#921: Updates the Zoekt submodule and documents the change in CHANGELOG.md.
• sourcebot-dev/sourcebot#1412: Updates Zoekt to upgrade bundled Go dependencies.
• sourcebot-dev/sourcebot#1503: Updates Zoekt and adds a changelog entry for a bundled dependency upgrade.

Suggested reviewers: msukkari

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the dependency upgrade and its security purpose, which matches the main changes in the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/cve/x-text

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}