deps: update vulnerable modules

[asddongmen]

What problem does this PR solve?

Issue Number: close #5830

TiCDC master still selected older go-jose, x/crypto, x/net, x/text, and gRPC
versions affected by reported security advisories.

What is changed and how it works?

• Update go-jose to v4.1.4.
• Update x/crypto to v0.53.0, x/net to v0.56.0, and x/text to v0.39.0.
• Update gRPC to v1.82.1.
• Accept only the Go-selected transitive dependency closure.

AWS eventstream v1.7.8 and S3 v1.97.3 were already fixed on master and
remain unchanged. GO-2026-5932 has no known fixed x/crypto version, but the
affected x/crypto/openpgp package is absent from TiCDC's complete package
graph.

Check List

Tests

• Unit test
  • GOPROXY=https://proxy.golang.org,direct make unit_test
• Manual test
  • make cdc
  • GOPROXY=https://proxy.golang.org,direct make check

Questions

Will it cause performance regression or break compatibility?

No expected regression. This changes only module metadata and passes the full
build, unit-test, and presubmit targets.

Do you need to update user documentation, design documentation or monitoring documentation?

No.

Release note

Upgrade dependencies to address known security vulnerabilities.

[ti-chi-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hongyunyan for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a2dbfe88-8b22-4f06-9806-69e1523d074e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}