build(deps): bump github.com/carabiner-dev/signer in /tools - #821

Kusari Analysis Results:

✅ No Flagged Issues Detected
All values appear to be within acceptable risk parameters.

Both analyses support proceeding. Dependency analysis: a routine Go module bump (tools/go.mod) carries over a pre-existing advisory, GHSA-vp52-pcj8-j9qc (CVE-2026-84304), affecting google.golang.org/grpc (DoS via HTTP/2 DATA frame fragmentation). This is not introduced or worsened by this PR (present before and after the bump from 1.82.1 to 1.83.0), and an actionable fix exists (bump to google.golang.org/grpc@v1.83.2, or temporarily set GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION). We recommend applying this fix in a follow-up but it does not warrant blocking this merge. All other dependency changes are routine version bumps under permissive licenses with no blocked/deprecated packages. Code analysis found no code issues, exposed secrets, or workflow issues. Combined risk profile remains low; recommend tracking the grpc upgrade to 1.83.2+ as a fast-follow action item.

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: fbbe17b, performed at: 2026-09-03T07:07:42Z