chore(deps): fix all open dependabot security alerts

[tac0turtle]

Overview

Clears all 30 open Dependabot alerts across the Go modules and the docs site.

Go modules (all indirect deps, bumped via go get + go mod tidy)

Module	Bump	Alerts cleared
tools/da-debug	golang.org/x/crypto v0.49.0 → v0.52.0, golang.org/x/net v0.52.0 → v0.55.0	13 alerts incl. 7 critical SSH advisories
root, apps/testapp, apps/evm, test/e2e	quic-go v0.59.0 → v0.59.1	HTTP/3 QPACK trailer expansion memory exhaustion (medium)
apps/loadgen	filippo.io/edwards25519 v1.1.0 → v1.1.1	MultiScalarMult invalid results (low)

Docs site

• VitePress 1.6.x pins vite 5 (EOL, no patched release) and VitePress 2.x is still alpha, so the patched versions are forced via yarn resolutions: vite ^6.4.3, esbuild ^0.25.0, lodash-es ^4.18.0. All three vulns are dev-server-only; yarn build verified passing with the forced versions.
• Removed stale docs/package-lock.json — the docs CI workflows only use yarn, so the npm lockfile just generated duplicate alerts.

Verification

• All six touched Go modules build clean
• Full unit test suite (just test, all go.mods) passes
• govulncheck clean on bumped modules
• yarn build in docs/ passes

Not actionable

govulncheck also flags GO-2024-3218 (Kademlia DHT content-censorship advisory in go-libp2p-kad-dht, reachable from pkg/p2p). No fixed version exists — it is a protocol-design issue every kad-dht consumer carries.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated networking, cryptography, system, and elliptic-curve libraries to newer patch versions.
  • Added version resolutions for key documentation build tools and utilities.
  • Kept dependency metadata otherwise unchanged.

[github-actions]

The latest Buf updates on your PR. Results from workflow CI / buf-check (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	⏩ skipped	✅ passed	⏩ skipped	Jul 16, 2026, 12:53 PM

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• execution/evm/go.sum is excluded by !**/*.sum
• execution/evm/test/go.sum is excluded by !**/*.sum

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 85f6b8e1-3b07-48bc-b88c-3c962d3076ab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Updates indirect Go dependencies across multiple modules, refreshes selected DA debug tool dependencies, and adds frontend dependency resolutions for the documentation package.

Changes

Dependency updates

Layer / File(s)	Summary
Go module dependency alignment go.mod, apps/*/go.mod, test/e2e/go.mod	Updates quic-go to v0.59.1 and edwards25519 to v1.1.1 across the affected Go modules.
DA debug dependency updates tools/da-debug/go.mod	Updates indirect versions of golang.org/x/crypto, golang.org/x/net, and golang.org/x/sys.
Documentation dependency resolutions docs/package.json	Adds enforced versions for esbuild, lodash-es, and vite.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• evstack/ev-node#1796: Updates overlapping golang.org/x/* dependency declarations.

Suggested labels: T:dependencies

Suggested reviewers: julienrbrt

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the dependency security alert cleanup across Go modules and docs.
Description check	✅ Passed	The description includes the required Overview and provides sufficient context, changes, and verification details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch marko/dep-security-bumps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-16 14:22 UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.32%. Comparing base (b4b895b) to head (b1b8974).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3388      +/-   ##
==========================================
- Coverage   62.34%   62.32%   -0.02%     
==========================================
  Files         120      120              
  Lines       13452    13452              
==========================================
- Hits         8386     8384       -2     
  Misses       4126     4126              
- Partials      940      942       +2     

Flag	Coverage Δ
combined	62.32% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.