[Krish6115]

Summary

Fixes #445

govulncheck v1.1.4 on current main reports 8 reachable vulnerabilities, more than the 3 in the issue:

• golang.org/x/net v0.57.0: GO-2026-6603, 6610, 6611, 6612, 6617 (fixed in v0.60.0)
• google.golang.org/grpc v1.79.3: GO-2026-6348, GO-2026-6061 (fixed in v1.83.1)
• go.opentelemetry.io/otel v1.39.0: GO-2026-5506 (fixed in v1.41.0)

This PR:

• Bumps golang.org/x/net to v0.60.0, google.golang.org/grpc to v1.83.1 and go.opentelemetry.io/otel to v1.44.0, which is the minimum that grpc v1.83.1 requires. go mod tidy pulled the other minimum-version upgrades (x/crypto, x/sys, x/text, genproto and similar). All of these releases are older than two weeks.
• Adds a govulncheck job to .github/workflows/ci.yml. It runs on every PR, like go-test, uses the same pinned checkout and setup-go actions, stubs webdist like the other Go jobs, installs govulncheck v1.1.4 and fails when any vulnerability is reachable. ci-summary now requires it.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• CI / build

Test plan

All run in a golang:1.26.10 container, with the same webdist stub as CI:

go mod tidy        no changes
go vet ./...       clean
go test -race -count=1 ./...    exit 0, 19 packages ok
govulncheck ./...  Your code is affected by 0 vulnerabilities. (exit 0)

Before the bump, the same govulncheck run reported: Your code is affected by 8 vulnerabilities from 3 modules.

govulncheck still notes some vulnerabilities in required modules that the code does not call. The new job only fails on reachable ones.

• Existing tests pass (go test -race -count=1 ./..., same as the go-test job)
• Added/updated tests for new behavior
• Manual testing (describe below)

Not tested: the new workflow job itself on GitHub Actions (it will run on this PR), the frontend build and the TypeScript SDK, which this change does not touch.

Security checklist

• No secrets or credentials in code
• No new unauthenticated endpoints
• Input validation on new API surfaces (no new API surface)
• Checked for OWASP top 10 (injection, XSS, etc.) (dependency and CI change only)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable regression was found.

Summary

Updates Go dependencies and adds a required govulncheck job.

• The Go app now uses patched networking, RPC, and tracing libraries.
• Pull-request CI now checks Go code for reachable vulnerabilities.

No actionable issues were found. This review did not run the tests or scanner.

_{Reviews (1) · Last reviewed commit: "ci: add govulncheck and bump modules wit..." · Reviewed by Greptile}