chore: fix Trivy findings and README badges

[appleboy]

Summary

The Trivy job failed on three HIGH vulnerabilities. Upgrade golang.org/x/crypto from v0.53.0 to v0.55.0 for CVE-2026-56854, and google.golang.org/grpc from v1.82.1 to v1.83.2 for CVE-2026-84304 and CVE-2026-84445.

Update their required transitive dependencies and regenerate go.sum. The local scan now reports zero HIGH/CRITICAL vulnerabilities; the workflow and severity threshold are unchanged. Remove the retired Go Report Card badge from README.md and scope the Trivy badge to main.

Related issues

No GitHub or Jira issue supplied; the failing workflow is linked above.

AI authorship

• AI was used
• Tool / model: Codex / GPT-6
• AI-authored files: go.mod, go.sum, README.md
• Human line-by-line reviewed: None — not yet reviewed by a human.

Change classification and scope

• Core change — shared networking and cryptography dependencies affect multiple packages.

Goal: resolve the reported dependency vulnerabilities with patched versions and their required transitive upgrades. Includes the requested README badge maintenance; no application code or workflow changes.

Verification

Setup

Check out chore/fix-trivy-dependencies and run commands from the repository root. Requires Go 1.26.8, make, Trivy 0.70.0, and network access for module/tool and vulnerability database downloads. No provider credentials or external services are required for these checks.

Automated checks

All results below were obtained locally on the exact dependency changes in this PR.

Command	Expected result / coverage	Status	Observed result
make fmt	Formatting succeeds	Passed	Exit 0
make lint	Dependencies remain compatible with lint	Passed	0 issues
go test ./...	Existing package and provider regressions pass	Passed	All packages passed
make build	CLI compiles with updated dependencies	Passed	Exit 0
go mod verify	Module checksums verify	Passed	all modules verified
git diff --staged --check	No whitespace errors	Passed	Exit 0
trivy fs --scanners vuln --severity CRITICAL,HIGH --exit-code 1 --format table .	Zero HIGH/CRITICAL findings; exit 0	Passed	Trivy 0.70.0, refreshed database, go.mod: 0 vulnerabilities

Regression scenario

Starting state: the linked CI run scans the previous dependency versions and exits 1 with three HIGH findings.

1. Check out this branch and run the Trivy command above with version 0.70.0. Expect zero HIGH/CRITICAL vulnerabilities and exit 0.
2. Run go test ./... and make build. Expect the existing tests and CLI build to succeed with the patched dependency graph.

Status: Passed locally. The scan returned zero findings and both compatibility checks succeeded. GitHub Actions for this PR has not yet been verified. No new test code was added for this dependency-only update; the vulnerability rescan is the targeted regression proof.

Cleanup: the build creates ignored bin/codegpt; Trivy and Go populate local caches. No application data or remote service state is created.

README badges

Passed: checked badge HTTP responses and SVG labels, and confirmed Go Report Card retirement at https://goreportcard.com/. Verify README.md no longer links to that retired service and all GitHub Actions badges select main. Existing failing CI badges reflect actual workflow results and are not overridden.

Security check

• No secrets in the diff
• Resolves the three reported dependency vulnerabilities without suppressions.
• Application input validation and permission checks are unchanged.

Risk and rollback

Transitive networking, telemetry, and RPC upgrades can affect downstream behavior; the existing suite and build passed. Revert this commit to roll back the dependency graph, which would reintroduce the reported findings.

Reviewer guide

Review the selected patched versions and required transitive upgrades in go.mod; spot-check generated go.sum changes. Recommend two reviewers, including a maintainer responsible for provider dependencies.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.