[chore] update go dependencies (#4304)

- github.com/KimMachineGun/automemlimit v0.7.2 => v0.7.3
- github.com/gin-contrib/cors v1.7.5 => v1.7.6
- github.com/minio/minio-go/v7 v7.0.92 => v7.0.94
- github.com/spf13/cast v1.8.0 => v1.9.2
- github.com/uptrace/bun{,/*} v1.2.11 => v1.2.14
- golang.org/x/image v0.27.0 => v0.28.0
- golang.org/x/net v0.40.0 => v0.41.0
- code.superseriousbusiness.org/go-swagger v0.31.0-gts-go1.23-fix => v0.32.3-gts-go1.23-fix

Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4304
Co-authored-by: kim <grufwub@gmail.com>
Co-committed-by: kim <grufwub@gmail.com>

vendor/github.com/ugorji/go/codec/decimal.go

@@ -8,6 +8,19 @@ import (
 	"strconv"
 )
 
+type readFloatResult struct {
+	mantissa uint64
+	exp      int8
+	neg      bool
+	trunc    bool
+	bad      bool // bad decimal string
+	hardexp  bool // exponent is hard to handle (> 2 digits, etc)
+	ok       bool
+	// sawdot   bool
+	// sawexp   bool
+	//_ [2]bool // padding
+}
+
 // Per go spec, floats are represented in memory as
 // IEEE single or double precision floating point values.
 //
@@ -234,6 +247,10 @@ func parseFloat64_custom(b []byte) (f float64, err error) {
 }
 
 func parseUint64_simple(b []byte) (n uint64, ok bool) {
+	if len(b) > 1 && b[0] == '0' { // punt on numbers with leading zeros
+		return
+	}
+
 	var i int
 	var n1 uint64
 	var c uint8
@@ -356,19 +373,6 @@ func parseNumber(b []byte, z *fauxUnion, preferSignedInt bool) (err error) {
 	return
 }
 
-type readFloatResult struct {
-	mantissa uint64
-	exp      int8
-	neg      bool
-	trunc    bool
-	bad      bool // bad decimal string
-	hardexp  bool // exponent is hard to handle (> 2 digits, etc)
-	ok       bool
-	// sawdot   bool
-	// sawexp   bool
-	//_ [2]bool // padding
-}
-
 func readFloat(s []byte, y floatinfo) (r readFloatResult) {
 	var i uint // uint, so that we eliminate bounds checking
 	var slen = uint(len(s))
@@ -384,13 +388,23 @@ func readFloat(s []byte, y floatinfo) (r readFloatResult) {
 		i++
 	}
 
-	// we considered punting early if string has length > maxMantDigits, but this doesn't account
+	// considered punting early if string has length > maxMantDigits, but doesn't account
 	// for trailing 0's e.g. 700000000000000000000 can be encoded exactly as it is 7e20
 
 	var nd, ndMant, dp int8
 	var sawdot, sawexp bool
 	var xu uint64
 
+	if i+1 < slen && s[i] == '0' {
+		switch s[i+1] {
+		case '.', 'e', 'E':
+			// ok
+		default:
+			r.bad = true
+			return
+		}
+	}
+
 LOOP:
 	for ; i < slen; i++ {
 		switch s[i] {