chore(deps): security updates — grpc, docker/cli, edwards25519

[arun-k-bharathan]

Summary

Consolidated replacement for three stale security-related Dependabot PRs:

• google.golang.org/grpc 1.74.2 → 1.82.1
• github.com/docker/cli 27.4.1+incompatible → 29.2.0+incompatible
• filippo.io/edwards25519 1.1.0 → 1.1.1

grpc goes to 1.82.1 rather than the 1.79.3 Dependabot proposed. 1.79.3 predates the fix for GO-2026-6061 (GHSA-hrxh-6v49-42gf), which govulncheck reports as reachable here through grpcurl. Taking 1.82.1 also means bumping the go directive from 1.25 to 1.25.0, since that is what grpc's own go.mod now declares.

The docker/cli bump is a major version jump: it swaps github.com/docker/docker for moby/moby/api and moby/moby/client. This is not confined to the test binary, since internal/psql/utils.go is non-test source and imports ory/dockertest/v3, which puts docker/cli in the build graph of lg itself. The swap also takes github.com/docker/docker out of go.mod and out of the import graph, which clears GO-2026-5668, GO-2026-4887 and GO-2026-4883. All three are reachable on main through dockertest.init, and all three report Fixed in: N/A, so staying on the old module path leaves no way to close them.

Overall govulncheck ./... drops from 14 reachable vulnerabilities on main to 9 on this branch. The 9 that remain have nothing to do with grpc, docker or edwards25519, and #126 handles them.

Source changes

go.mod and go.sum, plus one test fix. The interop/grpc_testing proto that grpc vendors gained a fillPeerSocketAddress field on ResponseParameters in 1.82.1, so it now shows up in --template output for the three streaming methods. I updated the expected-JSON assertions in internal/grpc/grpc_test.go (TestGRPC/CommandlineTemplate/Using_Server_Reflection) to match. The sibling Using Proto File subtest reads this repo's own testing/test.proto, so it needed no change.

Supersedes

• chore(deps): Bump google.golang.org/grpc from 1.74.2 to 1.79.3 #121: grpc 1.74.2 → 1.79.3
• chore(deps): Bump github.com/docker/cli from 27.4.1+incompatible to 29.2.0+incompatible #120: docker/cli 27.4.1+incompatible → 29.2.0+incompatible
• chore(deps): Bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 #119: edwards25519 1.1.0 → 1.1.1
• chore(deps): Bump google.golang.org/grpc from 1.74.2 to 1.77.0 #114: grpc 1.74.2 → 1.77.0 (obsolete)

Please close these after merging.

Test plan

• go build ./...
• make test (go test -count=1 -race ./...), the full suite including the Docker-backed integration tests for cql, lua, psql, mongo and kafka
• govulncheck ./... no longer reports GO-2026-6061, GO-2026-5668, GO-2026-4887 or GO-2026-4883
• make lint matches the main baseline (238 pre-existing findings, none new)
• CI on this PR

Related

The rest of the same cleanup, split up to keep each review small. I'd suggest merging in this order, which is not the order they were opened: this PR, then #126, #127, #128.

• chore(deps): security sweep — x/net, x/text, pgx, go-jose, mongo-driver, runc #126: the remaining security advisories govulncheck surfaced
• chore(deps): routine updates — protobuf, cobra, gopher-lua-libs #127: routine updates (protobuf, cobra, gopher-lua-libs)
• chore(deps): bump ClickHouse driver to 2.42.0 #128: the ClickHouse driver, which has behavioural changes, so it's best last

[samof76]

LGTM