chore(deps): upgrade deps and tools

[skevetter]

Signed-off-by: GitHub noreply@github.com

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	c7f784b
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a78cad4fc183b00083d69de

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)

• chore(deps)

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 54762138-01e5-4028-baad-1a06c48eb5ff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	c7f784b
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a78cad469c8f900082fd16c

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

While the PR successfully upgrades to Go 1.26.5 and adopts the modern tool directive for development dependencies, there are significant issues that should be addressed before merging.

The most critical concern is the presence of unaddressed high-severity vulnerabilities in docker/docker (CVE-2026-41567, CVE-2026-34040) and cel-go, despite this being a dependency upgrade chore. Additionally, the current implementation of the gRPC toolchain is likely to break; removing explicit go install commands for protoc plugins prevents them from being added to the system PATH, which protoc requires for execution. Finally, several tasks in Taskfile.yml still bypass the new version-pinning logic by using @latest or incorrect go get commands.

About this PR

• The PR description is empty. Please provide context for the Go version upgrade and confirm if the migration to the Go 1.24 tool directive covers all intended development environments.

Test suggestions

• Verify 'cli:build' tasks successfully execute using 'go tool goreleaser' with pinned versions.
• Verify 'cli:test:e2e' tasks correctly invoke 'go tool ginkgo' and respect the version defined in go.mod.
• Verify 'cli:build:grpc' correctly finds protoc plugins without manual install steps.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify 'cli:build' tasks successfully execute using 'go tool goreleaser' with pinned versions.
2. Verify 'cli:test:e2e' tasks correctly invoke 'go tool ginkgo' and respect the version defined in go.mod.
3. Verify 'cli:build:grpc' correctly finds protoc plugins without manual install steps.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[devsy-app]

All contributors have signed the CLA.
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

⚠️ This PR contains unsigned commits. To get your PR merged, please sign those commits (git rebase --exec 'git commit -S --amend --no-edit -n' @{upstream}) and force push them to this branch (git push --force-with-lease).

If you're new to commit signing, there are different ways to set it up:

Sign commits with gpg

Follow the steps below to set up commit signing with gpg:

1. Generate a GPG key
2. Add the GPG key to your GitHub account
3. Configure git to use your GPG key for commit signing

Sign commits with ssh-agent

Follow the steps below to set up commit signing with ssh-agent:

1. Generate an SSH key and add it to ssh-agent
2. Add the SSH key to your GitHub account
3. Configure git to use your SSH key for commit signing

Sign commits with 1Password

You can also sign commits using 1Password, which lets you sign commits with biometrics without the signing key leaving the local 1Password process.

Learn how to use 1Password to sign your commits.