fix: upgrade vulnerable Go dependencies to fix CRITICAL/HIGH CVEs

[qiluo-msft]

Why I did it

Trivy CVE scan identified multiple CRITICAL and HIGH severity vulnerabilities in the Go module dependencies of sonic-mgmt-common.

How I did it

Updated go.mod and regenerated go.sum via go mod tidy with the following version bumps:

Package	Old	New	CVEs Fixed
google.golang.org/grpc	v1.28.0	v1.82.1	CVE-2026-33186, GHSA-hrxh-6v49-42gf
golang.org/x/text	v0.3.3	v0.39.0	CVE-2020-14040, CVE-2021-38561, CVE-2022-32149, CVE-2026-56852
github.com/antchfx/xpath	v1.1.10	v1.3.6	CVE-2026-32287 (direct dependency)
github.com/antchfx/jsonquery	v1.1.4	v1.3.7	(parent of vulnerable xpath)
github.com/antchfx/xmlquery	v1.3.1	v1.5.1	(parent of vulnerable xpath)

How to verify it

trivy fs . --severity CRITICAL,HIGH

CRITICAL count should drop to 0 for these packages; HIGH count should decrease substantially.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Updates Go module dependencies in sonic-mgmt-common to remediate Trivy-reported CRITICAL/HIGH CVEs by bumping several direct dependencies (notably gRPC, x/text, and antchfx XPath stack) and refreshing the module sums.

Changes:

• Bump direct dependencies: google.golang.org/grpc, golang.org/x/text, and github.com/antchfx/{jsonquery,xmlquery,xpath} to newer, non-vulnerable versions.
• Refresh go.sum to match the updated dependency graph after module tidy/vendor regeneration.
• Update additional dependency/tooling pins implied by the upgrade (e.g., github.com/golang/glog, indirect modules, and the go directive).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
go.mod	Updates direct/indirect module versions (including gRPC, x/text, antchfx stack) and bumps the go directive.
go.sum	Regenerates module checksums to reflect the updated dependency graph.

Suppressed comments (3)

go.mod:10

• github.com/golang/glog is also patched during the vendoring step (patches/apply.sh applies patches/glog.patch). With the version bump here, the patch may need to be refreshed; otherwise the build can fail when applying patches. Please ensure the patch still applies to v1.2.5 (and update the patch if needed).

	github.com/golang/glog v1.2.5

go.mod:10

• PR description lists only grpc/x/text/antchfx upgrades, but this file also bumps github.com/golang/glog and the Go toolchain version. Please update the PR description (and CVE impact notes, if relevant) to reflect these additional changes so reviewers/consumers understand the full upgrade surface.

	github.com/golang/glog v1.2.5

go.mod:40

• Bumping the module go directive to 1.25.0 forces all builds (including CI) to use Go >= 1.25; older toolchains will error out before go mod vendor runs. Unless there is a hard requirement from updated deps, consider keeping the go directive at the previously supported version, or update the CI/build container/toolchain accordingly.

go 1.25.0

[qiluo-msft]

Superseded by updated PR addressing glog patch compatibility and go directive.