fix(deps): update dependencies with Dependabot security alerts

[skylenet]

This PR fixes the open Dependabot alerts in go.mod and ui/package-lock.json. It also fixes all the fixable findings that govulncheck reports.

Go

• Upgrade the vulnerable modules to their patched versions: podman 5.8.6, buildah 1.43.2, runc 1.3.6, grpc 1.83.2, x/crypto 0.57.0, x/net 0.60.0, x/text 0.42.0, klauspost/compress 1.18.7, go-chi/chi 5.3.0, otel 1.45.0, pgx 5.9.2, fulcio 1.8.6, go-jose 4.1.4, go-ethereum 1.17.0, gnark-crypto 0.18.1, aws-sdk-go-v2 s3 1.97.3 and moby/sys/user 0.4.1.
• x/net v0.60.0 needs Go 1.26.0. The go directive is now 1.26.0, and the toolchain is go1.26.9, which has the fixes for the standard library advisories. CI and the Dockerfile use Go 1.26.
• golangci-lint v2.3.0 cannot lint this Go version, so CI now uses v2.14.0. The install script is pinned to the release tag. The script on master fails its checksum check, because its grep also matches the new .sbom.json assets.

UI

• Upgrade vitest to v4 (this fixes the tinypool and @vitest/mocker alerts), echarts to 6.1 and @scalar/api-reference-react to 0.9.
• Add an overrides entry for @ai-sdk/provider-utils. Scalar pins a vulnerable 4.0.5 version through ai.
• Run npm audit fix for the transitive packages. npm audit now reports 0 vulnerabilities.

Not fixed

These advisories have no fixed version:

• github.com/docker/docker: The fix is a move to the github.com/moby/moby modules. That is a code change, so a separate PR must do it.
• golang.org/x/crypto GO-2026-5932, containers/buildah GO-2026-5116, containers/podman/v5 GO-2025-3961 and GO-2024-3042.

Tests

• go build and go vet pass, including a CGO_ENABLED=0 GOOS=linux build.
• govulncheck reports only the advisories without a fix.
• golangci-lint v2.14.0 with --new-from-rev=origin/master reports 0 issues.
• go test ./... passes on macOS, except TestBuildManifestExcludes and TestValidateDataDirMethods_SchelkBinary. Both also fail on master on macOS: one because of the /private tmpdir symlink, and one because macOS has no /proc/mounts.
• UI: npm run build and npm test (73 tests) pass. npm run lint shows the same 2 warnings as on master.

[redpandabot]

Summary

This PR bumps Go and npm dependencies to clear Dependabot alerts, and also moves CI/Dockerfile to Go 1.26 plus golangci-lint v2.14.0. The UI changes (vitest 4, echarts 6.1, Scalar 0.9, provider-utils override, npm audit fix) are clean, but five of the bumped Go modules are pinned to versions OSV still flags with fixed releases already available, so the security goal is only partly met. podman/buildah/docker/docker advisories have no patched version and remain, as the PR notes.

Issues

• 🔴 go.mod:198 — grpc pinned to a version OSV still flags — OSV reports GO-2026-6443 / GHSA-2v4p-qf9q-27wj (server panic via missing :authority/Host headers) affecting v1.83.1; it is fixed in v1.83.2, which is already available on the proxy. The bump from 1.77.0 leaves a fixable advisory in place.
• 🔴 go.mod:193 — x/net still vulnerable to fixable HTTP/2 advisories — see the thread on that line
• 🔴 go.mod:29 — x/crypto still vulnerable to fixable advisories — see the thread on that line
• 🔴 go.mod:112 — klauspost/compress pinned to a version with an OOB read — see the thread on that line
• 🔴 go.mod:195 — x/text pinned to a version with a parsing panic — OSV reports GO-2026-6629 (panic parsing crafted input in golang.org/x/text/secure/precis) affecting v0.40.0, fixed in v0.41.0, which is available.

---

_{Reviewed @ 58171d3a
"If you can't measure it, you can't improve it." — Peter Drucker}

[redpandabot]

Summary

Dependency-bump PR fixing the open Dependabot alerts: Go modules upgraded (podman 5.8.6, buildah 1.43.2, runc 1.3.6, grpc 1.83.2, x/crypto 0.57.0, x/net 0.60.0, otel 1.45.0, pgx 5.9.2, go-ethereum 1.17.0, gnark-crypto 0.18.1, modernc sqlite stack, etc.) with Go/toolchain moved to 1.26, CI and Dockerfile aligned, golangci-lint pinned to v2.14.0; UI bumps vitest to 4, echarts 6.1, scalar 0.9 with an override for @ai-sdk/provider-utils. I batch-queried OSV for all 199 Go modules and all 566 lockfile packages: the UI tree is fully clean and every module the PR set out to fix is clean at the new versions. The three open findings from the last review (x/net, x/crypto, klauspost/compress) are all resolved. Remaining OSV hits are docker/docker (unchanged from master, no patched version on the module path, explicitly deferred) and unfixable podman/buildah advisories that affected master's versions equally.

Issues

• 🟡 go.mod — OSV still lists podman and buildah advisories at the new versions, but no fixed release exists — OSV flags podman v5.8.6 with GO-2024-3042 (CVE-2024-3056) and GO-2025-3961 (CVE-2025-4953) and buildah v1.43.2 with GO-2026-5116 (CVE-2026-44517), each with only an introduced event and no fixed — no patched version exists, so the bump cannot close them and it does not regress master (5.8.0/1.43.0 were equally affected). Worth noting in the PR body alongside the docker/docker deferral so the alerts aren't assumed fixed.

---

_{Reviewed @ 6cc2c03a
"If you can't measure it, you can't improve it." — Peter Drucker}