chore(deps): consolidate Dependabot bumps and vulnerability fixes

[upsetbit]

Summary

Single consolidation of the open Dependabot version bumps and the open Dependabot alerts on pnpm-lock.yaml. AWS SDK packages are bumped together so smithy-go / internal modules stay compatible. npm tooling is bumped, and js-yaml / fast-uri are pinned via pnpm overrides so the six open alerts (DoS and host-confusion) resolve without waiting on parent packages.

Go 1.26.6 and golang.org/x/text v0.41.0 are included because govulncheck (CI security job) currently fails on master-equivalent Dependabot PRs for GO-2026-5970 and patched stdlib findings fixed in 1.26.6.

Published @c3-oss/q* package versions are unchanged.

Changes

Go modules

• github.com/aws/aws-sdk-go-v2 1.42.0 → 1.43.1
• github.com/aws/aws-sdk-go-v2/config 1.32.26 → 1.32.32
• github.com/aws/aws-sdk-go-v2/credentials 1.19.25 → 1.19.31
• github.com/aws/aws-sdk-go-v2/service/dynamodb 1.59.1 → 1.62.1
• go.mongodb.org/mongo-driver/v2 2.7.0 → 2.8.0
• Go toolchain 1.26.4 → 1.26.6 (stdlib govulncheck)
• golang.org/x/text 0.37.0 → 0.41.0 (GO-2026-5970)

npm tooling (root @c3-oss/q-tooling only)

• @commitlint/cli 21.0.2 → 21.2.1
• @commitlint/config-conventional 21.0.2 → 21.2.0
• lint-staged 17.0.8 → 17.2.0
• pnpm overrides: js-yaml ^4.3.1, fast-uri ^3.1.5 (lockfile now 4.3.2 / 3.1.6)

Test plan

• go test ./... (Go 1.26.6)
• go test -race -count=1 ./...
• go vet ./..., golangci-lint, gosec, govulncheck (0 affecting vulns)
• just quality via devbox (markdownlint, lychee, gitleaks, npm-check)
• just test-integration (testcontainers, Docker)
• just test-e2e (compose CLI checks)
• just build
• CI on this PR

Related

Supersedes Dependabot PRs:

• build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.26 to 1.32.32 #19 aws-sdk-go-v2/config 1.32.26 → 1.32.32
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/dynamodb from 1.59.1 to 1.62.1 #18 aws-sdk-go-v2/service/dynamodb 1.59.1 → 1.62.1
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.42.0 to 1.43.1 #17 aws-sdk-go-v2 1.42.0 → 1.43.1
• build(deps): bump go.mongodb.org/mongo-driver/v2 from 2.7.0 to 2.8.0 #16 mongo-driver/v2 2.7.0 → 2.8.0
• build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.25 to 1.19.31 #15 aws-sdk-go-v2/credentials 1.19.25 → 1.19.31
• build(deps): bump lint-staged from 17.0.8 to 17.2.0 #12 lint-staged 17.0.8 → 17.2.0
• build(deps): bump @commitlint/cli from 21.0.2 to 21.2.1 #11 @commitlint/cli 21.0.2 → 21.2.1
• build(deps): bump @commitlint/config-conventional from 21.0.2 to 21.2.0 #2 @commitlint/config-conventional 21.0.2 → 21.2.0

Dependabot alerts addressed (will close after merge):

• ci(deps): bump actions/cache from 5 to 6 #1 js-yaml GHSA-h67p-54hq-rp68 / CVE-2026-53550
• build(deps): bump @commitlint/config-conventional from 21.0.2 to 21.2.0 #2 fast-uri GHSA-4c8g-83qw-93j6 / CVE-2026-13676
• build(deps): bump @commitlint/cli from 21.0.2 to 21.2.0 #3 fast-uri GHSA-v2hh-gcrm-f6hx / CVE-2026-16221
• feat: implement q — read-only multi-database query CLI #4 js-yaml GHSA-52cp-r559-cp3m / CVE-2026-59869
• ci(release): publish homebrew cask to c3-oss/homebrew-q #5 fast-uri GHSA-7p8r-x3mc-p8w7 / CVE-2026-18446
• feat(npm): distribute q as an npm package #6 js-yaml GHSA-5p4m-2wfm-xmqj