Fix all 12 Dependabot security vulnerabilities in Go modules and npm

[Copilot]

12 Dependabot alerts across Go and npm dependencies, ranging from Critical to Low severity.

Go module upgrades (go.mod / go.sum)

Package	Old	New	Alerts
golang.org/x/crypto	v0.21.0	v0.49.0	ServerConfig.PublicKeyCallback auth bypass (Critical), DoS via slow key exchange (High), ssh unbounded memory (Moderate), ssh/agent malformed message panic (Moderate)
google.golang.org/grpc	v1.56.3	v1.79.3	Auth bypass via missing leading slash in :path (Critical)
golang.org/x/oauth2	v0.8.0	v0.36.0	Improper input validation (High)
github.com/hashicorp/go-getter	v1.7.6	v1.7.9	Symlink attacks (High)
golang.org/x/net	v0.23.0	v0.52.0	XSS (Moderate), HTTP proxy bypass via IPv6 zone IDs (Moderate)
github.com/ulikunitz/xz	v0.5.10	v0.5.15	Memory leak on corrupted LZMA input (Moderate)

npm — AWS SDK v2 → v3 migration (modules/llm_router/v0.1.0/lambda/)

Dependabot flagged aws-sdk v2 for missing region parameter validation. Migrated to the modular AWS SDK v3 which resolves the advisory and reduces Lambda bundle size.

// Before (v2)
const AWS = require('aws-sdk');
const dynamoDB = new AWS.DynamoDB.DocumentClient();
await dynamoDB.put({ ... }).promise();

// After (v3)
const { DynamoDBClient } = require('@aws-sdk/client-dynamodb');
const { DynamoDBDocumentClient, PutCommand } = require('@aws-sdk/lib-dynamodb');
const dynamoDB = DynamoDBDocumentClient.from(new DynamoDBClient({}));
await dynamoDB.send(new PutCommand({ ... }));

package.json updated to @aws-sdk/client-dynamodb and @aws-sdk/lib-dynamodb ^3.1014.0; package-lock.json regenerated. npm audit reports 0 vulnerabilities.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh gh auth status ux_amd64/compile/tmp/go-build2589491126/b169/ (http block)
• vuln.go.dev
  • Triggering command: /home/REDACTED/go/bin/govulncheck govulncheck ./... (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.