Bump deps to resolve CVEs

[inFocus7]

Context

Resolves CVEs by bumping dependencies.

Upgrades / Changes

Makefile

• argo-rollouts:1.10

Go modules

• otel:1.46
• grpc:1.83.2
• x/net:0.58
• x/text:0.41
• cilium:1.19.3
• docker/cli:v29.2.0
• go-jose:4.1.4
• jsonparse:1.1.2

Other changes related to go mod tidy

Safety

otel 1.40.0 -> 1.46.0 (releases): 6 breaking changes across; none apply; posted the ones that seemed relevant based on our direct usage:

• otlptracehttp / otlpmetrichttp WithEndpointURL no longer appends the default signal path: normalizeHTTPEndpoint (internal/telemetry/tracing.go) already appends /v1/traces, so the URL always has a path.
• sdk/metric default cardinality limit of 2000: no MeterProvider is ever constructed anywhere in the repo, so the SDK aggregation path never runs and the limit cannot apply
• Go 1.24 support dropped: module is on go 1.26.4

CVEs

CVEs scanned via trivy 0.70.0 + grype 0.114.0.

CVE	Severity	Package	Fixed in
CVE-2026-49445	CRITICAL	github.com/cilium/cilium v1.19.0	1.19.2, 1.18.8, 1.17.14
GHSA-3fcv-jvfp-m4q9	CRITICAL	github.com/cilium/cilium v1.19.0	1.19.2
CVE-2026-33186	CRITICAL	google.golang.org/grpc v1.72.1	1.79.3
GHSA-p77j-4mvh-x3m3	CRITICAL	google.golang.org/grpc v1.72.1	1.79.3
CVE-2026-27143	CRITICAL	stdlib go1.24.13	1.25.9, 1.26.2
CVE-2026-32285	HIGH	github.com/buger/jsonparser v1.1.1	1.1.2
GHSA-6g7g-w4f8-9c9x	HIGH	github.com/buger/jsonparser v1.1.1	1.1.2
CVE-2026-41520	HIGH	github.com/cilium/cilium v1.19.0	1.17.15, 1.18.9, 1.19.3
GHSA-gj49-89wh-h4gj	HIGH	github.com/cilium/cilium v1.19.0	1.19.3
CVE-2025-15558	HIGH	github.com/docker/cli v28.3.3+incompatible	29.2.0
GHSA-p436-gjf2-799p	HIGH	github.com/docker/cli v28.3.3+incompatible	29.2.0
CVE-2025-29786	HIGH	github.com/expr-lang/expr v1.16.9	1.17.0
CVE-2025-68156	HIGH	github.com/expr-lang/expr v1.16.9	1.17.7
GHSA-93mq-9ffx-83m2	HIGH	github.com/expr-lang/expr v1.16.9	1.17.0
GHSA-cfpf-hrx2-8rv6	HIGH	github.com/expr-lang/expr v1.16.9	1.17.7
CVE-2026-34986	HIGH	github.com/go-jose/go-jose/v4 v4.1.3	4.1.4
GHSA-78h2-9frx-2jm8	HIGH	github.com/go-jose/go-jose/v4 v4.1.3	4.1.4
CVE-2026-39883	HIGH	go.opentelemetry.io/otel/sdk v1.40.0	1.43.0
GHSA-hfvc-g4fc-pqhx	HIGH	go.opentelemetry.io/otel/sdk v1.40.0	1.43.0
CVE-2025-47913	HIGH	golang.org/x/crypto v0.41.0	0.43.0
GO-2025-4116	HIGH	golang.org/x/crypto v0.41.0	0.43.0
GO-2026-4559	HIGH	golang.org/x/net v0.50.0	0.51.0
CVE-2026-25679	HIGH	stdlib v1.24.13	1.25.8, 1.26.1
CVE-2026-27140	HIGH	stdlib go1.24.13	1.25.9, 1.26.2
CVE-2026-27144	HIGH	stdlib go1.24.13	1.25.9, 1.26.2
CVE-2026-32280	HIGH	stdlib v1.24.13	1.25.9, 1.26.2
CVE-2026-32281	HIGH	stdlib v1.24.13	1.25.9, 1.26.2
CVE-2026-32283	HIGH	stdlib v1.24.13	1.25.9, 1.26.2
CVE-2026-33811	HIGH	stdlib v1.24.13	1.25.10, 1.26.3
CVE-2026-39820	HIGH	stdlib v1.24.13	1.25.10, 1.26.3
CVE-2026-39836	HIGH	stdlib v1.24.13	1.25.10, 1.26.3
CVE-2026-42499	HIGH	stdlib v1.24.13	1.25.10, 1.26.3
CVE-2026-42501	HIGH	stdlib go1.24.13	1.25.10, 1.26.3
GO-2026-4601	HIGH	stdlib go1.24.13	1.25.8, 1.26.1
GO-2026-4870	HIGH	stdlib go1.24.13	1.25.9, 1.26.2
GO-2026-4946	HIGH	stdlib go1.24.13	1.25.9, 1.26.2
GO-2026-4947	HIGH	stdlib go1.24.13	1.25.9, 1.26.2
GO-2026-4971	HIGH	stdlib go1.24.13	1.25.10, 1.26.3
GO-2026-4977	HIGH	stdlib go1.24.13	1.25.10, 1.26.3
GO-2026-4981	HIGH	stdlib go1.24.13	1.25.10, 1.26.3
GO-2026-4986	HIGH	stdlib go1.24.13	1.25.10, 1.26.3

28 of the 41 come from the TOOLS_ARGO_ROLLOUTS_VERSION bump.
1.9.0 binary is built with go1.24.13 and vendors expr-lang/expr v1.16.9, golang.org/x/crypto v0.41.0 and grpc v1.72.1.
1.10.0 is built with go1.26.7. The remaining 13 come from the go.mod bumps.

[inFocus7]

CI/CD failure due to MCP server, changes shouldn't have touched it; not sure if a flake though (I don't have retry abilities)

• [FAILED] [19.889 seconds]
KAgent Tools Kubernetes E2E Tests [BeforeAll] KAgent Tools Deployment should have kagent-tools pods running
  [BeforeAll] /home/runner/work/tools/tools/test/e2e/k8s_test.go:33
  [It] /home/runner/work/tools/tools/test/e2e/k8s_test.go:53

  Timeline >>
  STEP: Creating namespace kagent-tools-e2e @ 09/18/26 16:13:07.327
  STEP: Installing KAgent Tools in namespace kagent-tools-e2e @ 09/18/26 16:13:07.548
  STEP: Installing CRDs for KAgent Tools @ 09/18/26 16:13:07.932
  STEP: Verifying KAgent Tools pods are running @ 09/18/26 16:13:27.033
  STEP: Validating KAgent Tools service is accessible @ 09/18/26 16:13:27.094
  [FAILED] in [BeforeAll] - /home/runner/work/tools/tools/test/e2e/k8s_test.go:41 @ 09/18/26 16:13:27.156
  STEP: Deleting namespace kagent-tools-e2e @ 09/18/26 16:13:27.156
  << Timeline

  [FAILED] Failed to get MCP client: failed to initialize MCP client: transport error: failed to send request: failed to send request: Post "http://127.0.0.1:30885/mcp": read tcp 127.0.0.1:38334->127.0.0.1:30885: read: connection reset by peer
  Unexpected error:
      <*fmt.wrapError | 0x2ef59e10e4c0>: 
      failed to initialize MCP client: transport error: failed to send request: failed to send request: Post "http://127.0.0.1:30885/mcp": read tcp 127.0.0.1:38334->127.0.0.1:30885: read: connection reset by peer
      {
          msg: "failed to initialize MCP client: transport error: failed to send request: failed to send request: Post \"[http://127.0.0.1:30885/mcp\](http://127.0.0.1:30885/mcp/)": read tcp 127.0.0.1:38334->127.0.0.1:30885: read: connection reset by peer",
          err: <*transport.Error | 0x2ef59e00aa60>{
              Err: <*fmt.wrapError | 0x2ef59e10e4a0>{
                  msg: "failed to send request: failed to send request: Post \"[http://127.0.0.1:30885/mcp\](http://127.0.0.1:30885/mcp/)": read tcp 127.0.0.1:38334->127.0.0.1:30885: read: connection reset by peer",
                  err: <*fmt.wrapError | 0x2ef59e10e480>{
                      msg: "failed to send request: Post \"[http://127.0.0.1:30885/mcp\](http://127.0.0.1:30885/mcp/)": read tcp 127.0.0.1:38334->127.0.0.1:30885: read: connection reset by peer",
                      err: <*url.Error | 0x2ef59dfe1e30>{
                          Op: "Post",
                          URL: "http://127.0.0.1:30885/mcp",
                          Err: <*net.OpError | 0x2ef59dda82d0>{
                              Op: "read",
                              Net: "tcp",
                              Source: <*net.TCPAddr | 0x2ef59dfe1da0>{IP: [127, 0, 0, 1], Port: 38334, Zone: ""},
                              Addr: <*net.TCPAddr | 0x2ef59dfe1dd0>{IP: [127, 0, 0, 1], Port: 30885, Zone: ""},
                              Err: <*os.SyscallError | 0x2ef59dee6000>{
                                  Syscall: "read",
                                  Err: <syscall.Errno>0x68,
                              },
                          },
                      },
                  },
              },
          },
      }
  occurred
  In [BeforeAll] at: /home/runner/work/tools/tools/test/e2e/k8s_test.go:41 @ 09/18/26 16:13:27.156
------------------------------
SSSSSS

Summarizing 1 Failure:
  [FAIL] KAgent Tools Kubernetes E2E Tests [BeforeAll] KAgent Tools Deployment should have kagent-tools pods running
  /home/runner/work/tools/tools/test/e2e/k8s_test.go:41