chore(deps): dependabot merge train 2026-09-01

[ArangoGutierrez]

Problem

Six Dependabot PRs were open against main. Merging them individually costs a
full CI matrix each and a rebase round every time they collide.

Two of them could not go green on their own. Dependabot split one atomic change
into separate PRs for github/codeql-action/init (#766) and
github/codeql-action/analyze (#764), but both steps run in the same job and the
action refuses to run mismatched versions:

Loaded a configuration file for version '4.37.8', but running version '4.37.9'

That is why #764 shows a red code-scanning check. Bumping both together, as
this PR does, is the only way either one passes.

Approach

Cherry-picked all six commits onto upstream/main (b6fefaf3), preserving
dependabot[bot] authorship, the original messages, and the
updated-dependencies trailers. Every commit is GPG-signed and carries both
Dependabot's and my DCO sign-off. No merge commits.

Superseded: #764, #765, #766, #767, #754, #755.

Dependency changes

Module	From	To
github/codeql-action (init, analyze, upload-sarif)	4.37.8	4.37.9
anchore/sbom-action	0.24.0	0.24.2
k8s.io/{api,apiextensions-apiserver,apimachinery,client-go,kubelet}	0.36.3	0.37.0
google.golang.org/grpc	1.83.1	1.83.2

The grpc bump is a security fix: it rejects requests missing both :authority
and Host headers (grpc/grpc-go#9365).

Conflict resolution

#755 (k8sio group) and #754 (grpc) were both cut from an older main and both
move the same four indirect modules to different versions. Resolved as a union,
keeping the newest of each:

Module	main	#755	#754	resolved
golang.org/x/mod	0.36.0	0.37.0	0.38.0	0.38.0
golang.org/x/net	0.56.0	0.57.0	0.58.0	0.58.0
golang.org/x/text	0.38.0	0.40.0	0.41.0	0.41.0
golang.org/x/tools	0.45.0	0.47.0	0.48.0	0.48.0

Because both PRs vendor those four modules, git's line-level merge produced
files mixing source from two different upstream releases (manifest.go,
deps.go, transport_wrap.go all auto-merged). Rather than trust that, the
vendored trees for x/mod, x/net, x/text and x/tools were taken whole
from #754 and confirmed byte-identical to it. The vendored package sets are the
same on both sides, so nothing k8s 0.37.0 needs was dropped.

k8s.io/* stays at 0.37.0 from #755; grpc takes 1.83.2 from #754.

Testing done

Run against the final tree, Go 1.26.6 on darwin/arm64:

• go build ./... clean
• go vet ./... clean
• go test -race -covermode=atomic $(go list ./... | grep -v vendor) 40 packages ok, 0 failures
• golangci-lint run ./... 0 issues
• go test -tags integration ./internal/ib/sysfs/... ./internal/pcisysfs/... ./shims/libpcisysfs/... ok
• govulncheck ./... no vulnerabilities

go.mod and vendor/modules.txt agree on all ten bumped modules. That consistency
is enforced by go build itself: reverting a single version line in
vendor/modules.txt turns the build red with inconsistent vendoring, which was
confirmed before relying on it.

make modules-check could not be validated locally. It fails the same way on
pristine upstream/main (module cache resolution errors on packages that do
exist), so it is a local environment limitation, not a property of this branch.
CI covers it on Linux.

Breaking changes

None. No first-party source changed; the diff is workflow pins, go.mod/go.sum,
and vendored dependencies.

[greptile-apps]

Too many files changed for review (985 files, 100 file limit).