chore: bump vulnerable go dependencies

[weicao]

Summary

This PR updates the Go dependencies that can be safely bumped within the current kbcli dependency graph to address Dependabot security alerts:

• golang.org/x/net v0.54.0 -> v0.55.0
• github.com/go-git/go-git/v5 v5.16.5 -> v5.19.1
• github.com/go-git/go-billy/v5 v5.6.2 -> v5.9.0
• oras.land/oras-go/v2 v2.6.0 -> v2.6.2
• github.com/containerd/containerd v1.7.32 -> v1.7.33
• go.mongodb.org/mongo-driver v1.15.1 -> v1.17.7

It also adds an explicit module replacement:

• replace github.com/cyphar/filepath-securejoin => github.com/cyphar/filepath-securejoin v0.5.2

Reason: after bumping go-git / go-billy, Go module resolution selects github.com/cyphar/filepath-securejoin v0.6.1. The current dependency graph still includes github.com/containers/storage v1.59.1, whose Linux files call the older OpenInRoot / Reopen APIs. Without this replacement, GitHub make-test fails during Linux type checking in golangci-lint run ./.... go-billy v5.9.0 only needs SecureJoin, which is still available in filepath-securejoin v0.5.2.

Expected covered Dependabot alerts:

• fix: fix kbcli addon index update always latest #59 golang.org/x/net < 0.55.0
• chore: fix KB version #58/chore: move init addon repo in index cmd #57/[Improvement] init default addon repo in index cmd #56/chore: fix import kb version #55/[BUG]kbcli login failed #53 oras.land/oras-go/v2 vulnerable ranges up to 2.6.1 or < 2.6.1
• chore: support continuous backup and restore #52/[Features] support continuous backup and restore #51 github.com/containerd/containerd < 1.7.33
• [BUG] update kubeblocks to new componentDefinition API verison #50 go.mongodb.org/mongo-driver < 1.17.7
• fix: modify kubeblocks pkg version #49/feat: use opsrequst to achieve backup and restore #45/feat: addon search #44/chore: add code owner and modify github issue assigness #38/[Features]support kbcli addon index #34/feat: cherry-pick #5801 in Kubeblocks #25/fix: add issue_prerelease.sh #24 github.com/go-git/go-git/v5
• [Improvement] kubeblocks config command do not stop KubeBlocks #40/chore: fix make-test fail #39 github.com/go-git/go-billy/v5 < 5.9.0

Validation

• go mod tidy
• go test ./...
• GOOS=linux go test ./pkg/preflight/interactive
• GOOS=linux go test -exec=true ./...
• git diff --check
• go list -m all | rg ... to verify the target module versions and the filepath-securejoin replacement

GitHub latest-head checks are green or expected skipped:

• trigger-mode: success
• size-label: success
• Push Pre-Check: success
• make-test: success
• cli-doc / build-kbcli: skipped

Boundaries

This PR does not force the following alerts because local validation showed they would break the current kbcli dependency graph, or there is no verifiable patched version available:

• chore: add action package #31 helm.sh/helm/v3: upgrading to v3.20.2 pulls Kubernetes v0.35.1 and structured-merge-diff/v6. With the repository's current replace k8s.io/* => v0.29.14, this causes structured-merge-diff/v6 vs v4 type mismatches. Lifting the Kubernetes replacements to v0.35.1 then conflicts with the current controller-runtime v0.17.2 and troubleshoot v0.57.0 APIs.
• chore: support kbcli milestone and release-notes #20/[Features] Refactor with KubeBlocks new api #22/[BUG] release action failed due to missing script #23/feat: only stop kubeblocks when kubeblocks version is specified #41/[Improvement] add auto-complete for edit config #42/[Features] addon search #43 Docker alerts: upgrading github.com/docker/cli / github.com/docker/docker makes ORAS v1 and k3d code conflict with the newer Docker module split into github.com/moby/moby/... packages.
• [BUG]kbcli cluster describe failed #54 oras.land/oras-go v1: the Dependabot advisory does not provide a first_patched_version, and the currently visible v1 latest version is still v1.2.7. This PR does not claim an unverifiable fix for that alert.

Note: #696 was closed and recreated because branch ava/fix-dependabot-security-20260714 failed the kbcli branch-name precheck. This PR uses the allowed hotfix/ prefix.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 39.94%. Comparing base (40171fe) to head (0758e65).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #697   +/-   ##
=======================================
  Coverage   39.94%   39.94%           
=======================================
  Files         172      172           
  Lines       24031    24031           
=======================================
  Hits         9599     9599           
  Misses      13310    13310           
  Partials     1122     1122           

Flag	Coverage Δ
unittests	39.94% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[weicao]

Focused review for latest head 0758e65df02135b56d2644072f5db284dd5dbf7a: 0 blocker for this module-only Dependabot security update.

What I checked:

• Current-head diff is only go.mod / go.sum; no production code or runtime script changes.
• Target module versions resolve as intended:
  • golang.org/x/net v0.55.0
  • github.com/go-git/go-git/v5 v5.19.1
  • github.com/go-git/go-billy/v5 v5.9.0
  • oras.land/oras-go/v2 v2.6.2
  • github.com/containerd/containerd v1.7.33
  • go.mongodb.org/mongo-driver v1.17.7
• filepath-securejoin resolves as v0.6.1 => v0.5.2; this is deliberate and build-relevant, not an accidental downgrade. go-git/go-billy v5.9.0 only imports securejoin.SecureJoin, while github.com/containers/storage v1.59.1 still imports the older Linux APIs OpenInRoot, OpenatInRoot, and Reopen. The pinned v0.5.2 module contains all of those APIs.
• XP contract classes 1-8: no silent fallback/runtime-state/NotFound/cleanup/operator-precedence risk introduced because the PR does not change execution logic. The only contract boundary is module resolution; the replace is explicit and is covered by Linux compile checks.

Direct validation I ran locally:

• go mod tidy produced no diff.
• go test ./...
• GOOS=linux go test -exec=true ./...
• GOOS=linux go test ./pkg/preflight/interactive
• git diff --check origin/main...HEAD && git diff --check
• go list -m github.com/go-git/go-git/v5 github.com/go-git/go-billy/v5 github.com/cyphar/filepath-securejoin github.com/containerd/containerd oras.land/oras-go/v2 go.mongodb.org/mongo-driver golang.org/x/net
• go mod why -m github.com/cyphar/filepath-securejoin

GitHub latest-head checks are also closed: trigger-mode, size-label, Push Pre-Check, and make-test are SUCCESS; cli-doc and build-kbcli are SKIPPED.

Boundary: I did not verify the GitHub Dependabot UI itself after merge; this review confirms the PR diff, resolved module graph, and local/GitHub build compatibility for the updated dependency set.