fix(security): go security fixes (2026-08-03)

[github-actions]

Batch Go dependency security updates for Dependabot alerts (minimum severity: moderate).

Included fixes:

• ALERT-1116 (high): gRPC-Go xDS RBAC/HTTP2 vulnerabilities — google.golang.org/grpc 1.64.1/1.73.0 → 1.82.1 (affected members now pinned at 1.82.1)
• CVE-2026-33186 (critical): gRPC-Go HTTP/2 vulnerability — google.golang.org/grpc 1.64.1/1.73.0 → 1.82.1
• ALERT-838 (medium): aws-sdk-go-v2 eventstream vulnerability — github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream 1.7.5 → 1.7.8
• ALERT-837 (medium): aws-sdk-go-v2 S3 vulnerability — github.com/aws/aws-sdk-go-v2/service/s3 1.89.1 → 1.97.3
• CVE-2025-64329 (high): containerd vulnerability in transitive graph — github.com/containerd/containerd 1.7.18 → not present (via confluent-kafka-go/v2 update)
• CVE-2024-25621 (medium): containerd vulnerability in transitive graph — github.com/containerd/containerd 1.7.18 → not present (via confluent-kafka-go/v2 update)
• CVE-2023-25153 (medium): containerd OCI importer memory exhaustion — github.com/containerd/containerd 1.7.18 → not present
• CVE-2023-25173 (medium): containerd supplementary groups setup issue — github.com/containerd/containerd 1.7.18 → not present
• CVE-2022-31030 (medium): containerd CRI ExecSync host memory exhaustion — github.com/containerd/containerd 1.7.18 → not present
• CVE-2022-23471 (medium): containerd CRI stream server host memory exhaustion — github.com/containerd/containerd 1.7.18 → not present

Skipped (already satisfied / would downgrade / no actionable fix):

• CVE-2026-34040 and related github.com/docker/docker alerts requiring 29.3.1: skipped. Go module tags for github.com/docker/docker currently resolve up to v28.5.2+incompatible; v29.3.1 is not available on that module path, so go get github.com/docker/docker@v29.3.1 fails (unknown revision).
• github.com/docker/docker alerts with empty fixed_version (e.g. <= 28.5.2, < 29.3.1): skipped due missing actionable floor in alert data.
• github.com/go-acme/lego, github.com/dgrijalva/jwt-go, and gopkg.in/square/go-jose.v2 entries with empty fixed_version: skipped due missing actionable floor and/or module not present in workspace members.
• All other Go alerts in this run were already satisfied at or above their fixed floors after these updates.

Risks:

• github.com/confluentinc/confluent-kafka-go/v2 was bumped from v2.14.0 to v2.15.0 in affected modules to remove vulnerable transitive containerd v1 usage.
• This is a dependency-graph update spanning multiple bulker workspace members; reviewers may split high-risk portions if desired.

Verification:

• go -C bulker work sync
• go -C bulker/admin build ./...
• go -C bulker/bulkerapp build ./...
• go -C bulker/config-keeper build ./...
• go -C bulker/connectors/firebase build ./...
• go -C bulker/ingest build ./...
• go -C bulker/ingress-manager build ./...
• go -C bulker/jitsubase build ./...
• go -C bulker/kafkabase build ./...
• go -C bulker/operator build ./...
• go -C bulker/reprocessing-worker build ./...
• go -C bulker/sync-controller build ./...

[jitsu-code-review]

Reviewed the dependency updates in across the provided compare range, including / and the new updates.\n\nI did not find actionable bugs, security issues, or correctness regressions in the change set.\n\nValidation: ran in each touched Go module (, , , , , , , , , , ), and all modules verified successfully.

[jitsu-code-review]

Reviewed the dependency updates in bulker across the provided compare range, including go.mod/go.sum and the new go.work.sum updates.

I did not find actionable bugs, security issues, or correctness regressions in the change set.

Validation: ran go mod verify in each touched Go module (admin, bulkerapp, config-keeper, connectors/firebase, ingest, ingress-manager, jitsubase, kafkabase, operator, reprocessing-worker, sync-controller), and all modules verified successfully.