chore(deps): update go deps

[mbrandenburger]

This PR updates various direct and indirect go deps.

[github-actions]

Hey @mbrandenburger 👋 thanks for the PR!
I'm your friendly PR Helper Bot 🤖 and I'll be riding shotgun on this one, keeping track of your PR's status to help you get it approved and merged.

This comment updates automatically as you push changes -- think of it as your PR's live scoreboard!
Here's the latest:

---

PR Checks

✅ DCO Sign-off -- All commits have valid sign-offs. Nice work!

---

❌ GPG Signature -- Heads up! The following commits don't have a verified GPG signature:

• 88dc9e6 chore(deps): update go deps

You'll need to sign your commits with GPG (e.g. git commit -S). See the Signing Guide for a step-by-step walkthrough.

---

✅ Merge Conflicts -- No merge conflicts detected. Smooth sailing!

---

❌ Issue Link -- This PR is not linked to any issue.

Please reference an issue using a closing keyword (e.g. Fixes #123) and ensure the issue is assigned to you. Every PR needs a home!

---

⏳ All checks must pass before this PR can be reviewed. You've got this!

[Effi-S]

Hi @mbrandenburger ,

I have some additional suggestions
in .github/scripts/package.json
eslint -> 10.8.1
globals -> 17.11.0

This can Avoid https://osv.dev/GHSA-rgw5-rvv9-x895
(After npm install transitive "node_modules/brace-expansion" should be 5.0.9 in package-lock.json)

[Effi-S]

Nice!
These changes solve OSV deps:

golang.org/x/crypto -> v0.55.0 (https://osv.dev/GO-2026-5932 )
golang.org/x/mod -> v0.40.0 (https://osv.dev/GO-2026-6180 , https://osv.dev/GO-2026-6179 )
golang.org/x/text -> v0.41.0
golang.org/x/net -> v0.58.0
golang.org/x/tools -> v0.49.0

[mbrandenburger]

Hi @mbrandenburger ,

I have some additional suggestions in .github/scripts/package.json eslint -> 10.8.1 globals -> 17.11.0

This can Avoid https://osv.dev/GHSA-rgw5-rvv9-x895 (After npm install transitive "node_modules/brace-expansion" should be 5.0.9 in package-lock.json)

Good catch! I will address the dep updates for our GH bot in a separate PR.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request