deps(dm): update vulnerable dependencies for nextgen

[GMHDBJD]

What problem does this PR solve?

Issue Number: ref #12768

The BYOC image scan reports vulnerable Go runtime/library versions in the gobinary findings for tidbcloud/dm:feature-importinto and tidbcloud/dm:v26.3.3-nextgen. Rocky Linux and other base-image packages are intentionally excluded because the release team owns the image/OS refresh.

This backport is manually reimplemented on the freshly fetched release-nextgen-202603 tip (7ef1518c, tag v26.3.3) rather than cherry-picked, so the release branch's TiDB, TiKV, PD, and other dependency pins remain intact.

The vulnerability database also advanced after the original report/master change was prepared:

• GO-2026-6061 requires google.golang.org/grpc >= v1.82.1.
• GO-2026-5158 requires the affected OpenTelemetry modules to move from v1.43.x to v1.44.0.
• GO-2026-5942 and GO-2026-5970 require golang.org/x/net >= v0.56.0 and golang.org/x/text >= v0.39.0.

What is changed and how it works?

• Upgrade the repository Go baseline to 1.25.12 in the root module, synchronized auxiliary modules, and the integration-test toolchain image.
• Upgrade the libraries identified by the gobinary scan, including:
  • filippo.io/edwards25519 to v1.1.1
  • github.com/Azure/go-ntlmssp to v0.1.1
  • github.com/apache/thrift to v0.23.0
  • AWS SDK V2 EventStream/S3 to v1.7.8/v1.97.3
  • github.com/dvsekhvalnov/jose2go to v1.7.0
  • github.com/go-jose/go-jose/v4 to v4.1.4
  • golang.org/x/crypto, x/net, x/sys, and x/text to v0.53.0, v0.56.0, v0.46.0, and v0.39.0
• Remove the stale golang.org/x/text => v0.28.0 replacement so the effective version is no longer held below the fixed floor.
• Upgrade grpc-go to v1.82.1 and align the OpenTelemetry core/metric/SDK/trace modules at v1.44.0; accept only the dependency closure selected by MVS and regenerate go.sum with go mod tidy.
• Keep the release branch's TiDB pseudo-version unchanged. Commit 3adc8ec is a descendant of upstream fix commit 3d68bd2 for GO-2024-3284, although version-only matching cannot recognize that ancestry.

The final symbol-level source scan no longer reports GO-2026-6061, GO-2026-5158, GO-2026-5942, GO-2026-5970, or GO-2026-5764 as findings.

Residual govulncheck findings and triage

The scan is not completely finding-free:

• GO-2026-5736, etcd server v3.5.15: the affected EtcdServer.Txn symbol is reachable, but exploitation requires etcd built-in authentication/RBAC and a valid lower-privileged etcd user. DM's embedded-etcd configuration does not enable that auth/RBAC model. The coordinated etcd upgrade remains tracked under Vulnerable dependencies #12637.
• GO-2026-5046/5047/5048, hamba/avro v2.30.0: advisory metadata covers the package without precise vulnerable symbols, so reachable init/Freeze functions are reported as symbol findings. DM links this module transitively through Pulsar configuration; no attacker-controlled DM Avro decode path was found. Remediation needs a separately tested maintained-fork migration and allocation-limit configuration.
• GO-2024-3284, TiDB: pseudo-version mapping false positive; the selected TiDB commit contains the upstream fix as described above.
• GO-2026-5841, klauspost/compress v1.18.2: the affected s2 package is imported, but the vulnerable s2.NewDict symbol is not called.
• GO-2026-5932, x/crypto/openpgp, and GO-2022-0635/0646, AWS SDK V1 S3 Crypto: module-only results; the affected packages are not imported by the scanned DM source.

These are documented follow-up/exception items rather than failures of the dependency remediations in this PR.

Check List

Tests

• Unit test
  • env -u HTTP_PROXY -u HTTPS_PROXY -u NO_PROXY GOTOOLCHAIN=go1.25.12 make dm_unit_test (all DM packages, race detector, and failpoints)
• Manual test
  • GOTOOLCHAIN=go1.25.12 go mod tidy -diff
  • GOTOOLCHAIN=go1.25.12 go mod verify
  • GOTOOLCHAIN=go1.25.12 make tidy
  • GOTOOLCHAIN=go1.25.12 make dm
  • GOTOOLCHAIN=go1.25.12 make cdc engine sync-diff-inspector
  • go version -m bin/{dm-master,dm-worker,dmctl,dm-syncer} (all built with Go 1.25.12, grpc-go v1.82.1, and OpenTelemetry v1.44.0)
  • govulncheck -scan=symbol -format=json ./cmd/dm-master ./cmd/dm-worker ./cmd/dm-ctl ./cmd/dm-syncer ./dm/... with Go 1.25.12 and the vulnerability database updated on 2026-07-27
• Integration test
  • Request DM integration and compatibility CI after opening this PR, with focus on S3/import-into, HTTP proxy, GBK, TLS, and gRPC/etcd communication paths.

Questions

Will it cause performance regression or break compatibility?

No performance regression or intentional compatibility break is expected. This PR changes dependency/toolchain versions only, preserves release-specific pins, passes the complete race-enabled DM unit suite, and builds DM plus shared-dependency binaries. DM integration and compatibility CI are requested as the final compatibility gates.

Do you need to update user documentation, design documentation or monitoring documentation?

No. The source report is used only to select gobinary dependency remediations; this PR does not change product behavior or user-facing documentation. Image/OS package remediation remains owned by the release team.

Release note

None

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6a8b1940-67d3-4a85-a7cd-483fcfcb5e8e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign suzaku for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[GMHDBJD]

/test pull-dm-integration-test-next-gen

[GMHDBJD]

/test pull-dm-integration-test-next-gen

[GMHDBJD]

/retest

[ti-chi-bot]

@GMHDBJD: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-dm-integration-test-next-gen	2858458	link	true	/test pull-dm-integration-test-next-gen

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.