security: upgrade critical dependencies to fix vulnerabilities

[raullenchai]

Summary

This PR addresses multiple security vulnerabilities found during Phase 1 security audit by upgrading critical dependencies to their latest patched versions.

Vulnerabilities Fixed

1. HTTP/3 QPACK Header Expansion DoS (CRITICAL)

• Vulnerability: GO-2025-4233
• Module: github.com/quic-go/quic-go
• Old Version: v0.49.0
• New Version: v0.55.0
• Impact: Denial of Service via header expansion attacks

2. Unchecked Memory Allocation in Vector Deserialization (HIGH)

• Vulnerability: GO-2025-4087
• Module: github.com/consensys/gnark-crypto
• Old Version: v0.16.0
• New Version: v0.18.1
• Impact: Memory exhaustion during genesis initialization

3. Excessive Memory Allocation in JWT Parsing (MEDIUM)

• Vulnerability: GO-2025-3553
• Module: github.com/golang-jwt/jwt
• Old Version: v4.5.1
• New Version: v4.5.2
• Impact: Memory exhaustion during JWT token parsing

Changes Made

Dependency Updates

• Updated quic-go from v0.49.0 to v0.55.0
• Updated gnark-crypto from v0.16.0 to v0.18.1
• Updated golang-jwt/jwt/v4 from v4.5.1 to v4.5.2

Testing

• ✅ Ran go test ./pkg/compress - All tests passing
• ✅ Ran go test ./ioctl/newcmd/jwt - All tests passing
• ✅ Ran go test ./blockchain/genesis - All tests passing
• ✅ Verified API compatibility - No breaking changes

Security Impact

These upgrades fix critical security vulnerabilities that could lead to:

• Denial of Service attacks
• Memory exhaustion
• Network manipulation

References

• quic-go Security Advisory
• gnark-crypto Security Advisory
• golang-jwt Security Advisory

Checklist

• Updated dependencies in go.mod
• Ran go mod tidy
• Ran go test ./... (selected critical packages)
• Verified no breaking changes
• Added security notes to commit message

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ envestcc
❌ Raullen

---

Raullen seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud