Fix possible fix(deps): 11 vulnerable dependencies in go.mod

[begininvoke]

Proposing a fix for something flagged in go.mod. It is around line 1.

CRITICAL: CVE-2026-33186 — authorization bypass in gRPC-Go. The installed version v1.67.3 accepts HTTP/2 requests whose :path pseudo-header omits the mandatory leading slash (e.g., 'Service/Method' instead of '/Service/Method'). These non-canonical paths are routed to the handler, but path-based authorization interceptors (including the official grpc/authz RBAC package and any custom interceptor using info.FullMethod) compare the raw path against policy rules. Deny rules defined with canonical paths fail to match, so requests slip through any fallback 'allow' rule. Impact: attackers able to send raw HTTP/2 frames with malformed :path can bypass deny-based access controls on protected methods. Risk is CRITICAL for servers using path-based authz with deny rules and a default-allow posture; low/no impact for servers without such policies.

Updates indirect dependencies to patched versions, addressing CVEs for grpc, net, text, and mod.

For reference: rule CVE-2026-33186. Rated critical.

I do not know the codebase, so please check the change fits how the rest of it works. Happy to adjust it or close this if the reasoning is off.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}