fix: upgrade vulnerable Go dependencies to address Dependabot alerts - #10

Summary

This PR upgrades three transitive Go dependencies to patched versions, resolving all 15 open Dependabot security alerts.

Changes

Also pulls in minor upgrades to related transitive dependencies (golang.org/x/sys, golang.org/x/text, golang.org/x/oauth2, golang.org/x/sync, OpenTelemetry, and genproto) required by go mod tidy.

Security Issues Addressed

Critical (7 alerts)

• golang.org/x/crypto (Refactor: upgrade deps, improve reliability, update docs and tooling #4, feat(operator): operator UI, GitHub PAT auth, AI rule suggester #7, feat(auth): add Kanopy CorpSecure auth mode for operator UI #8, fix: upgrade vulnerable Go dependencies to address Dependabot alerts #10, #11, #12, #14): SSH/FIDO auth bypass, infinite loop, server deadlock, and related vulnerabilities — fixed in v0.52.0

High (3 alerts)

• golang.org/x/crypto (Fix: upgrade grpc-go to v1.79.3 for CVE-2026-33186 #5, chore: enable MDB auditing #6): RSA/DSA DoS and byte arithmetic underflow — fixed in v0.52.0
• google.golang.org/grpc (#17): xDS RBAC and HTTP/2 vulnerabilities — fixed in v1.82.1

Medium (5 alerts)

• golang.org/x/crypto (fix(deps): bump x/crypto to 0.52.0 and x/net to 0.55.0 #9, #13, #15, #16): Certificate restriction bypass, client panic, server panic, memory leak — fixed in v0.52.0
• golang.org/x/net (Monorepo fixes #3): HTML parser denial of service — fixed in v0.55.0

Dependabot Alerts Resolved

Closes #3, #4, #5, #6, #7, #8, #9, #10, #11, #12, #13, #14, #15, #16, #17

Test plan

• go mod tidy completes successfully
• go test ./... passes

Made with Cursor