Novatechflow/dependabot vuln remediation

[novatechflow]

Summary

• Remediates fixable Dependabot vulnerabilities in Go and npm dependencies.
• Addresses multiple open Code Scanning findings (CodeQL + Scorecard) in code, workflows, and Dockerfiles.
• Keeps @aws-sdk/xml-builder pinned while forcing safe transitive fast-xml-parser.

Testing

• go test ./...
• make test-produce-consume (broker changes)
• make test-consumer-group (group changes)

Checklist

• Added/updated unit tests for new logic
• Added/updated e2e coverage for bug fixes
• Added license headers to new files

[novatechflow]

@kamir / @klaudworks - pls review

[klaudworks]

The go tests for nested modules such as addons/processors/sql-processor are currently not part of the CI pipelines.
I noticed these tests failing cause of a missing go.sum entry for golang.org/x/crypto/bcrypt.

 go test ./internal/metadata

go mod tidy should fix it.

[novatechflow]

The go tests for nested modules such as addons/processors/sql-processor are currently not part of the CI pipelines. I noticed these tests failing cause of a missing go.sum entry for golang.org/x/crypto/bcrypt.

 go test ./internal/metadata

go mod tidy should fix it.

aren't they? let me check.

[novatechflow]

good catch @klaudworks! Fixed :)