Fix CVEs in release-0.23

[dfarrell07]

See commit messages for details.

Summary by CodeRabbit

• Security

  • Refined vulnerability tracking to remove outdated exceptions and accurately identify an unresolved security issue.
  • Updated underlying networking, system, text, synchronization, and tooling components to newer versions.

• Maintenance

  • Improved the application’s security posture and compatibility through routine component updates.

[submariner-bot]

🤖 Created branch: z_pr4153/dfarrell07/fix-0.23-cves-2026-08-21
🚀 Full E2E won't run until the "ready-to-test" label is applied. I will add it automatically once the PR has 2 approvals, or you can add it manually.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6f95a969-fa17-44dd-9e7b-230133d44f44

📥 Commits

Reviewing files that changed from the base of the PR and between 018e1bb and 166fbc6.

⛔ Files ignored due to path filters (2)

• go.sum is excluded by !**/*.sum
• tools/go.sum is excluded by !**/*.sum

📒 Files selected for processing (3)

• .grype.yaml
• go.mod
• tools/go.mod

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

---

Walkthrough

The change updates golang.org/x/* dependency versions in both Go modules and revises Grype ignore rules for protobuf CVEs and GO-2026-5932.

Changes

Dependency and security updates

Layer / File(s)	Summary
Vulnerability ignore policy .grype.yaml	Removes two protobuf CVE ignore entries and adds fix-state: not-fixed to the GO-2026-5932 entry.
Go module version updates go.mod, tools/go.mod	Updates direct and indirect golang.org/x/* dependency versions in both modules.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 166fb

This dependency and vulnerability metadata update is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

Suggested reviewers: vthapar, skitt

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Actionable Comments Resolved	❌ Error	PR #4153 has an unresolved actionable bot comment: full E2E requires the missing ready-to-test label; the PR has zero labels and zero reviews.	Apply the ready-to-test label, or obtain two approvals so the bot adds it, then run the full E2E test.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the dependency and vulnerability remediation changes in the release-0.23 branch.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}