fix(deps): bump golang.org/x/text and google.golang.org/grpc for HIGH CVEs

[dwertent]

Summary

Remediates two HIGH severity findings in the shared root go.mod used by the Go components, including op-node.

Package	From	To	Advisory	Severity
golang.org/x/text	v0.38.0	v0.39.0	CVE-2026-56852	HIGH
google.golang.org/grpc	v1.79.3	v1.82.1	GHSA-hrxh-6v49-42gf	HIGH

Transitively pulled forward by go mod tidy: go.opentelemetry.io/otel/sdk/metric -> v1.43.0, golang.org/x/mod -> v0.37.0, golang.org/x/tools -> v0.47.0, golang.org/x/telemetry, and google.golang.org/genproto/googleapis/{api,rpc}.

Base branch

Targets release-op-node/v1.18.2, which is the authoritative build pin consumed by the wrapper workflow that produces the op-node image. The fix must land here to reach the shipped image.

Monorepo scoping

This repository contains multiple components and ecosystems, so the change was deliberately kept minimal. The vulnerable Go modules live in the root go.mod, which is shared across the Go components, so the root manifests are the correct and only place to fix this.

Complete list of files changed — 2 files:

go.mod
go.sum

• There is no go.work / go.work.sum in this repository, so none were touched.
• No files under op-node/** required changes — the bump is manifest-only.
• The Rust / Cargo tree (rust/**) was not touched, nor was any other non-Go component. Verified with git status before committing.

Explicitly out of scope

golang.org/x/net is already at v0.56.0 (fixed) and was deliberately left unchanged.

Verification

• go build ./op-node/... — passes
• go build -o /dev/null ./op-node/cmd/main.go — passes (binary links)
• go build ./op-service/... ./op-batcher/... ./op-proposer/... ./op-supervisor/... ./op-conductor/... — passes, confirming the shared root go.mod bump does not break sibling Go components
• Resolved versions confirmed via go list -m:
  • golang.org/x/text v0.39.0
  • google.golang.org/grpc v1.82.1
  • golang.org/x/net v0.56.0 (unchanged, already fixed)
• No vulncheck target exists in this repo's Makefile / justfile.

One pre-existing build failure, unrelated to this change

A repo-wide go build ./... fails with:

op-core/superchain/chain.go:20:12: pattern superchain-configs.zip: no matching files found

This is a missing generated/embedded asset that requires a codegen step, and it reproduces identically on the unmodified base branch. It is unrelated to this dependency bump and does not affect op-node.

---

Reported by Pipeline / CVE - Trigger run 30995014323 (https://github.com/kaleido-io/kaleido-app-cloud/actions/runs/30995014323)

[Copilot]

Pull request overview

This PR remediates two HIGH severity dependency findings in the repository’s root Go module manifests (shared across Go components like op-node) by bumping golang.org/x/text and google.golang.org/grpc, along with the expected transitive updates produced by go mod tidy.

Changes:

• Bump golang.org/x/text to v0.39.0 and google.golang.org/grpc to v1.82.1 in the root go.mod.
• Pull forward related transitive module versions (e.g., golang.org/x/mod, golang.org/x/tools, golang.org/x/telemetry, and google.golang.org/genproto/...) and update checksums accordingly in go.sum.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
go.mod	Updates root module requirements to the patched versions for x/text and grpc, plus tidy-driven transitive bumps.
go.sum	Refreshes module checksums to match the updated dependency graph after the version bumps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.