chore(deps): update module github.com/moby/spdystream to v0.5.1

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/moby/spdystream	v0.5.0 → v0.5.1

---

Release Notes

moby/spdystream (github.com/moby/spdystream)

v0.5.1

Compare Source

What's Changed

Security

Fix memory amplification in SPDY frame parsing leads to denial of service (CVE-2026-35469 / GHSA-pc3f-x583-g7j2)

Changes

• spdy: fix duplicate license headers, add LICENSE, PATENTS, and update NOTICE #​106
• ci: update actions and test against latest Go versions #​107
• use ioutil.Discard for go1.13 compatibility #​109

Full Changelog: moby/spdystream@v0.5.0...v0.5.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:40 PM UTC · Completed 10:45 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

Review — PR #211

Verdict: Approve

Summary

This PR bumps the indirect dependency github.com/moby/spdystream from v0.5.0 to v0.5.1. The update is a patch-level version bump that addresses CVE-2026-35469 (memory amplification in SPDY frame parsing leading to denial of service). The change was created by the automated MintMaker/Renovate bot.

Analysis

Dimension	Assessment
Correctness	✅ Mechanical version bump in go.mod (1 line) and corresponding hash update in go.sum (2 lines). The /go.mod checksum base is unchanged, confirming the module path is stable. Change is consistent and correct.
Security	✅ Positive change — patches a known CVE. No new attack surface introduced.
Intent & coherence	✅ Appropriately scoped automated dependency update. Only dependency manifest files are modified.
Style & conventions	✅ Standard Go module dependency management. No issues.
Documentation	✅ No documentation changes needed for a transitive dependency bump.
Cross-repo contracts	✅ Indirect (transitive) dependency with a patch-level bump. No API surface changes that could affect consumers.

Findings

No findings. This is a straightforward, security-motivated dependency patch bump with no behavioral risk.

Previous run

Looks good to me

Previous run (2)

Looks good to me

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:47 AM UTC · Completed 6:51 AM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 5:28 AM UTC · Completed 5:29 AM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:37 PM UTC · Completed 9:40 PM UTC
Commit: 58b0710 · View workflow run →