[rachita-17]

What

Clears the Dependabot alert backlog on master in one PR.

Go — direct bumps across all 13 modules

google.golang.org/grpc      v1.82.1 / v1.83.0 -> v1.83.2   (13 modules)
go.opentelemetry.io/otel*   v1.44.0           -> v1.45.0   (13 modules)
github.com/cilium/ebpf      v0.20.0           -> v0.22.0   (root, terraform, terraform-mwi)
github.com/apache/thrift    v0.23.0           -> v0.24.0   (root)

npm — transitive pins via overrides in pnpm-workspace.yaml

@xmldom/xmldom            0.8.13  -> 0.8.15
fast-uri                  3.1.5   -> 3.1.8
js-yaml                   3.15.1  -> 3.15.2,  4.3.1 -> 4.3.2
browserslist              4.28.2  -> 4.29.1
baseline-browser-mapping  2.10.32 -> 2.11.26
esbuild                   0.27.7  -> 0.28.1
undici (6.x transitive)   6.28.0  -> 6.29.0

npm — direct bump

undici (e2e/package.json)  ^8.10.0 -> ^8.10.2   (resolves to 8.11.2)

All six are transitive dependencies, so they are pinned ahead of their parents. Each override should be dropped once its parent ships the fixed version.

Why v1.83.2 and not v1.83.1

CVE-2026-84445 carries two vulnerable ranges:

< 1.82.2             -> patched in 1.82.2
>= 1.83.0, < 1.83.2  -> patched in 1.83.2

v1.83.1 satisfies only the first and stays vulnerable under the second. This PR originally pinned 1.83.1 and was corrected.

Notes for review

• Overrides go in pnpm-workspace.yaml, not package.json. pnpm 11 no longer reads the pnpm field in package.json and ignores it silently — the first attempt here changed nothing and gave no error.
• js-yaml is split by major because the lockfile carries both 3.x and 4.x and the advisory patches them separately.
• The esbuild override is range-scoped to >=0.27.3 <0.28.1. The lockfile also holds 0.25.12, outside the vulnerable range; a blanket bump would move it three minors for no security benefit.
• undici needs both a direct bump and an override. CVE-2026-85024 covers >= 6.25.0 < 6.28.1 and >= 8.1.0 < 8.10.2. The lockfile holds an 8.x line declared in e2e/package.json and a 6.x line pulled in transitively. Bump undici from 8.10.0 to 8.10.2 #21 bumps only the declared 8.x dep and leaves 6.x vulnerable. 7.29.0 is outside both ranges and untouched.
• moby/go-archive alerts are stale — go.mod and e2e/runner/go.mod already read v0.3.0.

Upstream gravitational/teleport has not picked any of these up; its last commit (1283425b60, 2026-08-25) predates the advisories. This PR diverges from upstream until it catches up.

Warning

master now sits deliberately ahead of upstream. Future syncs must use a normal git merge upstream/master, keeping the higher version on any go.mod / go.sum / lockfile conflict. A merge -s ours sync (as used in #11) would silently revert every fix in this PR.

Verification

Root module compiles against the grpc/otel bumps — confirmed by CI on this PR:

SUCCESS  Build on Mac OS
SUCCESS  Build on Windows
SUCCESS  Build API

Locally, go build ./... returned exit 0 with no compiler output for all 12 non-root modules at the v1.83.1 stage of this branch.

Not built locally: the root module at any stage, the v1.83.1 -> v1.83.2 patch bump, and the ebpf/thrift/npm commit. CI is the gate for all of it.

The ruleset does not require status checks, so CI can be bypassed at merge time. Failing checks are Check Contributor License Agreement Signed (gravitational's bot, N/A on this fork), Checking reviewers, Lint (Docs) and Validate the changelog entry — upstream process jobs, not compile failures.

Expected result

Open alerts on master: 104 -> 0.

Supersedes

#9, #10, #14, #15, #16, #17, #18, #19, #21 — per-module and per-package bumps of the same dependencies. All should auto-close once this lands.

🤖 Generated with Claude Code