Bump dependencies to clear Dependabot alerts

[drk1rd]

Upgrades dependencies to patched versions for the open Dependabot alerts, keeping churn small.

cli/go.mod

Alert(s)	Package	Before	After
#4, #36, #63, #64, #65	github.com/docker/docker	v27.4.1+incompatible (indirect)	removed
#124, #125, #126	google.golang.org/grpc	v1.82.1	v1.83.1
#123	github.com/moby/sys/user	v0.1.0	v0.4.1

• docker/docker was only pulled in indirectly by github.com/fsouza/go-dockerclient (used by internal/dockertest). Four of the five docker/docker alerts have no patched release for that module path (last release is v28.5.2, all affected). go-dockerclient v1.13.2 migrated to github.com/moby/moby/client v0.4.1 + github.com/moby/moby/api v1.54.2, so bumping it from v1.12.0 drops docker/docker from the module graph. No source changes were needed.
• v1.13.2 is used instead of v1.13.3 because v1.13.3 requires go 1.26. With v1.13.2 the go directive stays at 1.25.8, so the CI toolchain doesn't change.

console/package-lock.json

Alert(s)	Package	Before	After
#121, #122	next (+ eslint-config-next)	15.5.26	15.5.28 (same major)
#120	source-map-js	1.2.1	1.2.2
#119	braces	3.0.3	not fixable: no patched release exists (3.0.3 is the latest). Only reachable through eslint-config-next -> @next/eslint-plugin-next -> fast-glob -> micromatch, so it's a lint-time dev dependency and isn't in the build output.

Verification

• go build ./... && go vet ./... && GOOS=linux go build ./...: ok
• Docker-backed tests against OrbStack: internal/runtime, internal/dockertest, internal/svc/lambda, internal/server, internal/svc/ec2 -short, internal/system, internal/svc/rds -short: all ok
• console: npm ci && npx tsc --noEmit && npm run build && npm run build:demo: ok

Summary by CodeRabbit

• Chores
  • Updated dependencies used by the CLI and web console, including Docker-related tooling and the Next.js framework.

[cloudflare-workers-and-pages]

Deploying homecloud with    Cloudflare Pages

Latest commit:	289cd42
Status:	✅  Deploy successful!
Preview URL:	https://60000663.homecloud.pages.dev
Branch Preview URL:	https://deps-security.homecloud.pages.dev

View logs

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3384f4d4-4723-4a8a-a400-cbdc404ab343

📥 Commits

Reviewing files that changed from the base of the PR and between 3c60c3a and 289cd42.

⛔ Files ignored due to path filters: 2

• cli/go.sum is excluded by !**/*.sum
• console/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 2

• cli/go.mod
• console/package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The pull request updates dependencies in the Go CLI module and the console package. The Go changes include go-dockerclient and related indirect dependencies. The console changes update the Next.js and ESLint configuration dependency ranges.

Changes: Go CLI dependencies

Layer / File(s)	Summary
Go module dependency update cli/go.mod	Upgrades go-dockerclient and updates related Moby, Google RPC, and gRPC dependencies. Removes several indirect requirements, including Docker and gogo/protobuf dependencies.

Console dependencies

Layer / File(s)	Summary
Next.js dependency update console/package.json	Updates the eslint-config-next and next dependency ranges from ^15.5.26 to ^15.5.28.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 289cd

This PR updates Go and console dependencies to clear security alerts. The flagged vulnerable code paths are not used by the CLI, and no blocking risk remains.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: updating dependencies to address Dependabot alerts.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}