fix(deps): update vulnerable dependencies to patched versions

[matthyx]

Description

This PR updates dependencies that have available security patches to address open Dependabot alerts on kubescape/node-agent.

Updated Dependencies & Addressed Advisories

1. github.com/cilium/cilium: updated from v1.17.15 to v1.17.16
   • Resolves Alert reduce map init size #108 (GHSA-q6h5-q3q6-f87x / CVE-2026-53935)
2. github.com/containerd/containerd: updated from v1.7.30 to v1.7.33
   • Resolves Alert lower memory and cpu usage #100 (GHSA-xhf5-7wjv-pqxp / CVE-2026-53488)
   • Resolves Alert sync call to getSBOM, remove leaking span #99 (GHSA-jpcc-p29g-p8mq / CVE-2026-47262)
   • Resolves Alert Build wf #97 (GHSA-fqw6-gf59-qr4w / CVE-2026-46680)
3. github.com/go-git/go-billy/v5: updated from v5.8.0 to v5.9.0
   • Resolves Alert Dockerfile correction #88 (GHSA-qw64-3x98-g7q2 / CVE-2026-44973)
   • Resolves Alert watch on SBOM summaries #87 (GHSA-m3xc-h892-ggx6 / CVE-2026-44740)
4. github.com/go-git/go-git/v5: updated from v5.18.0 to v5.19.2
   • Resolves Alert use fullPath if not empty #112 (GHSA-8g3w-hx67-27v6)
   • Resolves Alert fix instanceID detection #111 (GHSA-v472-7476-q58q)
   • Resolves Alert File based file name storage backend implementation #101 (GHSA-w5pp-99ch-qj29)
   • Resolves Alert Adding pprofile #96 (GHSA-crhj-59gh-8x96 / CVE-2026-45571)
   • Resolves Alert add runc path for bitdefender #95 (GHSA-m7cr-m3pv-hgrp / CVE-2026-45570)
   • Resolves Alert update to the right golang version #86 (GHSA-389r-gv7p-r3rp / CVE-2026-45022)
5. github.com/google/cel-go: updated from v0.26.1 to v0.29.0
   • Resolves Alert reduce allocations when adding files #110 (GHSA-w374-2whf-pp64)
   • Adapted cel.NewStaticOptimizer call site to handle error return value in pkg/rulemanager/cel/cel.go
6. github.com/in-toto/in-toto-golang: updated from v0.9.0 to v0.11.0
   • Resolves Alert add builder #85 (GHSA-pmwq-pjrm-6p5r)
7. go.mongodb.org/mongo-driver: updated from v1.17.6 to v1.17.7
   • Resolves Alert Excessive memory usage in node agent when relevancy feature is on #98 (GHSA-cp6g-7hqx-qxhp / CVE-2026-2303)
8. golang.org/x/image: updated from v0.38.0 to v0.41.0
   • Resolves Alert Remove files after creating SBOM #107 (GHSA-q675-qj96-32m9 / CVE-2026-46599)
9. oras.land/oras-go/v2: updated from v2.6.0 to v2.6.2
   • Resolves Alert refactor inmemory file handler #106 (GHSA-vh4v-2xq2-g5cg)
   • Resolves Alert update logs #105 (GHSA-fxhp-mv3v-67qp / CVE-2026-50163)
   • Resolves Alert Replace bolt db #104 (GHSA-8xwf-rjm4-xvhv / CVE-2026-50162)
   • Resolves Alert Replace bolt db #103 (GHSA-jxpm-75mh-9fp7 / CVE-2026-50151)
   • Resolves Alert fix #102 (GHSA-xf85-363p-868w / CVE-2026-48978)

How to test

• Run go build ./... and verify compilation succeeds.
• Run go test ./... to run unit test suites.

Summary by CodeRabbit

• Bug Fixes

  • Improved reliability when initializing expression evaluation. Configuration errors are now detected early and reported clearly instead of allowing setup to continue unsuccessfully.

• Chores

  • Updated several underlying components and security-related libraries to newer versions.
  • Added support for newer attestation functionality and removed an outdated utility dependency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 2abcf3da-8e1c-41a2-84ba-57b091d88871

📥 Commits

Reviewing files that changed from the base of the PR and between 1243ba3 and 0db9185.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• go.mod
• pkg/rulemanager/cel/cel.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Dependency versions are updated in go.mod. NewCEL now checks and wraps errors from cel.NewStaticOptimizer.

Changes

Dependency and CEL construction updates

Layer / File(s)	Summary
Dependency version updates go.mod	Multiple direct and indirect dependencies are updated. Two indirect dependencies are added, and one indirect dependency is removed.
CEL optimizer error handling pkg/rulemanager/cel/cel.go	NewCEL checks the error from cel.NewStaticOptimizer and returns a wrapped failure when construction fails.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 0db91

This PR applies patched dependency versions and makes CEL initialization failures explicit without changing exposed behavior. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: entlein, alonliwsky

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: updating vulnerable dependencies to patched versions. It matches the pull request objectives and dependency changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-updates

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Performance Benchmark Results

Node-Agent Resource Usage

Metric	BEFORE	AFTER	Delta
Avg CPU (cores)	0.130	0.128	-1.9%
Peak CPU (cores)	0.141	0.139	-1.7%
Peak CPU p95 (cores)	0.140	0.139	-0.8%
Avg Memory (MiB)	374.512	310.561	-17.1%
Peak Memory (MiB)	377.562	314.895	-16.6%

Dedup Effectiveness

No data available.