fix(security): remediate CVE vulnerabilities in release-0.10

[ulucinar]

Summary

This PR fixes CVE vulnerabilities identified by security scanning.

Vulnerabilities Fixed

CVE/GHSA	Severity	Package	Fixed Version
GHSA-vp52-pcj8-j9qc	High	google.golang.org/grpc	v1.83.1
GHSA-qc2q-p7wx-3px3	Medium	google.golang.org/grpc	v1.83.1
GHSA-2v4p-qf9q-27wj	High	google.golang.org/grpc	v1.83.1

Changes Made

• Updated google.golang.org/grpc from v1.82.1 to v1.83.1
• Ran go mod tidy to update go.sum

References

• GHSA-vp52-pcj8-j9qc
• GHSA-qc2q-p7wx-3px3
• GHSA-2v4p-qf9q-27wj

Verification

• Rescanned with cve-scan skill after fixes
• All listed vulnerabilities resolved

[ulucinar]

Build Failure Analysis

Check: build (amd64)
Status: Failed
Analyzed: 2026-09-12T10:06:00Z

Summary

The build (amd64) check failed due to a transient network error when pulling the buildkit Docker image.

Root Cause

Network connection reset during Docker Hub authentication. The TCP connection to Docker Hub's auth service (auth.docker.io) was interrupted, preventing the buildkit image from being pulled.

Error Details

ERROR: Error response from daemon: Head "https://registry-1.docker.io/v2/moby/buildkit/manifests/buildx-stable-1": Get "https://auth.docker.io/token?account=githubactions&scope=repository%3Amoby%2Fbuildkit%3Apull&service=registry.docker.io": read tcp 10.1.0.40:56908->172.64.144.78:443: read: connection reset by peer

The failure occurred at the docker/setup-buildx-action@v3 step when attempting to pull moby/buildkit:buildx-stable-1.

Recommendation

Retry the workflow. This is a transient infrastructure failure unrelated to the code changes. The connection reset is a temporary network issue that should resolve on retry.

---

_{This analysis was generated by the build-failure-analyze skill.}