GeezerVison

The next src-cli release is blocked on vulnerability scanning: trivy fs --severity HIGH,CRITICAL on main reports 12 HIGH findings across go.mod and lib/go.mod, and the repository has six open Dependabot alerts. All of them are transitive Go dependencies; no code changes are needed.

This bumps every flagged module to its first patched version (or the minimum version the upgrade graph requires) in both go.mod and the vendored lib/go.mod, and lets go mod tidy pull the transitive closure along:

x/crypto, x/text, and x/mod land above their first patched versions because golang.org/x/[email protected] requires them. grpc goes to v1.83.2 rather than v1.83.1 because Trivy still flags v1.83.1 for CVE-2026-84445.

This also fixes renovate.json, which has had a doubled comma after the "$schema" key since #1179. Renovate refused to parse it and stopped opening dependency PRs for this repository, which is part of why these findings piled up. Fixes #1345.

Test Plan

• go build ./..., go vet ./..., and go test ./... pass on this branch.
• trivy fs --exit-code 1 --severity LOW,MEDIUM,HIGH,CRITICAL . exits 0 with no findings in go.mod, lib/go.mod, or npm-distribution/package-lock.json (before: 12 HIGH).
• npx --package renovate renovate-config-validator renovate.json reports Config validated successfully.
• The open Dependabot alerts (Use $EDITOR to define campaign name/desc if not given #91–a8n: add branch flag for creating campaigns #96) should auto-close once this merges, and Renovate should resume opening PRs.