gomod

• CVE-2026-48708 - OliveTin template race command contamination 2026-06-25
• CVE-2026-40884 - goshs empty-username SFTP authentication bypass 2026-05-03