[eddietejeda]

Summary

Clears the npm audit and govulncheck findings that have a fix.

Go

• Go 1.27.2 → 1.27.3 (go.mod, release.yml): fixes GO-2026-6809 (crypto/x509), which govulncheck reported as reachable from the HTTP client. govulncheck is now clean.
• grafana-plugin-sdk-go v0.296.5 → v0.297.0 (pulls grpc 1.84.0, otel 1.47.0).

npm (8 findings → 4), via overrides, matching the existing pattern:

Package	Severity	From → To	Path
zod	high	4.6.5 → 4.6.7	@grafana/data, eslint-plugin-react-hooks
fast-uri	moderate	3.1.8 → 3.1.9	copy-webpack-plugin → ajv
ip-address	moderate	10.7.2 → 10.7.4	@grafana/sign-plugin → socks
serialize-javascript	low	7.1.2 → 7.1.4	copy-webpack-plugin

@grafana/plugin-e2e stays at 3.11.1: 3.15.3 fails setVisualization on Grafana 12.4.13 in CI.

Remaining (4 moderate, one advisory): react-router GHSA-wrjc-x8rr-h8h6 / GHSA-337j-9hxr-rhxg via @grafana/ui → react-router-dom-v5-compat. Not shipped: @grafana/ui and react-router are webpack externals supplied by Grafana at runtime (dist/module.js contains no react-router code). npm's suggested fix is a downgrade to @grafana/ui 11.2. @grafana/* 13.2.4 was tried, but it requires React 19 and still includes the advisory.

Testing

• go test ./pkg/..., go vet, govulncheck: clean.
• npm run typecheck, npm run lint, webpack build.
• Playwright e2e against the mock stack: 7/7 pass.