Wiz: Upgrade multiple dependencies (resolves 149 findings)

[wiz-betterup]

Wiz has created this PR to fix 149 findings detected in this project

Changes were made to the following file(s):

• balancer/go.mod
• balancer/go.sum
• cluster-autoscaler/go.mod
• vertical-pod-autoscaler/e2e/go.mod
• vertical-pod-autoscaler/go.mod
• vertical-pod-autoscaler/go.sum

Vulnerabilities:

Component	Findings	Locations
github.com/docker/distribution 2.8.1+incompatible → 2.8.2-beta.1	CVE-2023-2253	/cluster-autoscaler/go.mod /vertical-pod-autoscaler/e2e/go.mod
github.com/golang-jwt/jwt/v4 4.4.2 → 4.5.2	CVE-2025-30204 CVE-2024-51744	/cluster-autoscaler/go.mod
github.com/moby/spdystream 0.2.0 → 0.5.1	CVE-2026-35469	/cluster-autoscaler/go.mod /vertical-pod-autoscaler/e2e/go.mod
github.com/opencontainers/runc 1.1.4 → 1.3.6	CVE-2025-52881 CVE-2023-28642 CVE-2024-21626 CVE-2023-27561 CVE-2025-31133 CVE-2025-52565 CVE-2023-25809 CVE-2026-41579 CVE-2024-45310	/cluster-autoscaler/go.mod /vertical-pod-autoscaler/e2e/go.mod
github.com/opencontainers/selinux 1.10.0 → 1.13.0	CVE-2025-52881	/cluster-autoscaler/go.mod /vertical-pod-autoscaler/e2e/go.mod
github.com/sirupsen/logrus 1.8.1 → 1.8.3	CVE-2025-65637	/vertical-pod-autoscaler/e2e/go.mod
github.com/sirupsen/logrus 1.9.0 → 1.9.1	CVE-2025-65637	/cluster-autoscaler/go.mod
go.opentelemetry.io/contrib/instrumentat- ion/github.com/emicklei/go-restful/otelr- estful 0.35.0 → 0.44.0	CVE-2023-45142	/cluster-autoscaler/go.mod /vertical-pod-autoscaler/e2e/go.mod
go.opentelemetry.io/contrib/instrumentat- ion/google.golang.org/grpc/otelgrpc 0.40.0 → 0.46.0	CVE-2023-47108	/cluster-autoscaler/go.mod
go.opentelemetry.io/contrib/instrumentat- ion/net/http/otelhttp 0.35.0 → 0.44.0	CVE-2023-45142	/vertical-pod-autoscaler/e2e/go.mod
go.opentelemetry.io/contrib/instrumentat- ion/net/http/otelhttp 0.40.0 → 0.44.0	CVE-2023-45142	/cluster-autoscaler/go.mod
golang.org/x/crypto 0.1.0 → 0.52.0	CVE-2026-39832 CVE-2026-42508 CVE-2026-39834 CVE-2026-46595 CVE-2024-45337 CVE-2026-39833 CVE-2026-39830 CVE-2026-39831 CVE-2026-46597 CVE-2025-47913 CVE-2025-22869 CVE-2026-39829 CVE-2023-48795 CVE-2025-47914 CVE-2025-58181 CVE-2026-39828 CVE-2026-46598 CVE-2026-39827 CVE-2026-39835	/vertical-pod-autoscaler/e2e/go.mod
golang.org/x/crypto 0.8.0 → 0.52.0	CVE-2024-45337 CVE-2026-39834 CVE-2026-46595 CVE-2026-39831 CVE-2026-39832 CVE-2026-39833 CVE-2026-42508 CVE-2026-39830 CVE-2025-47913 CVE-2026-46597 CVE-2025-22869 CVE-2026-39829 CVE-2026-39828 CVE-2025-47914 CVE-2026-46598 CVE-2025-58181 CVE-2023-48795 CVE-2026-39835 CVE-2026-39827	/cluster-autoscaler/go.mod
golang.org/x/net 0.0.0-20220722155237-a158d28d115b → 0.55.0	CVE-2026-39821 CVE-2023-45288 CVE-2022-41723 CVE-2022-27664 CVE-2023-44487 CVE-2023-39325 CVE-2022-41721 CVE-2025-22870 CVE-2025-22872 CVE-2023-3978 CVE-2026-25680 CVE-2022-41717	/balancer/go.mod
golang.org/x/net 0.3.1-0.20221206200815-1e63c2f08a10 → 0.55.0	CVE-2026-39821 CVE-2023-39325 CVE-2023-45288 CVE-2023-44487 CVE-2022-41723 CVE-2023-3978 CVE-2025-22872 CVE-2026-25680 CVE-2025-22870 CVE-2022-41717	/vertical-pod-autoscaler/e2e/go.mod
golang.org/x/net 0.8.0 → 0.55.0	CVE-2026-39821 CVE-2023-45288 CVE-2023-44487 CVE-2023-39325 CVE-2025-22872 CVE-2023-3978 CVE-2026-25680 CVE-2025-22870	/vertical-pod-autoscaler/go.mod
golang.org/x/net 0.9.0 → 0.55.0	CVE-2026-39821 CVE-2023-45288 CVE-2023-39325 CVE-2023-44487 CVE-2025-22870 CVE-2026-25680 CVE-2025-22872 CVE-2023-3978	/cluster-autoscaler/go.mod
golang.org/x/oauth2 0.0.0-20211104180415-d3ed0bb246c8 → 0.27.0	CVE-2025-22868	/balancer/go.mod
golang.org/x/oauth2 0.0.0-20220223155221-ee480838109b → 0.27.0	CVE-2025-22868	/vertical-pod-autoscaler/e2e/go.mod /vertical-pod-autoscaler/go.mod
golang.org/x/oauth2 0.7.0 → 0.27.0	CVE-2025-22868	/cluster-autoscaler/go.mod

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[wiz-betterup]

⚠️ Lock file update issue

Please update the lock file manually before merging this PR.

cluster-autoscaler/go.sum

Internal Error

vertical-pod-autoscaler/e2e/go.sum

Internal Error