Close the 21 Dependabot alerts in the retirement proof's Go module #5047

🤖 Generated by the Agentic Engineer

Evidence

All 21 open Dependabot alerts on this repository's default branch (7 critical, 5 high, 8 moderate, 1 low) come from one file: scripts/retire-backstage-stateless/poller-native/go.mod. It pins indirect dependencies that have published fixes: golang.org/x/crypto (13 alerts, fixed from 0.52.0/0.55.0), oras.land/oras-go/v2 (7 alerts, fixed from 2.6.1/2.6.2) and golang.org/x/net (1 alert). The alerts have been open since 2026-10-13 and no update pull request has been proposed for this module.

Audience and problem

The maintainer and both agent lanes read the repository's security tab. The module is a test-only harness for the Backstage retirement proof, so the vulnerable code is unlikely to be reachable. But 21 open alerts, 7 of them critical, hide any real new alert behind noise, and nothing proposes the updates on its own.

Hypothesis

Moving the module's indirect dependencies to their fixed versions closes all 21 alerts. Making sure the dependency updater covers this nested module stops the count from building up again.

Acceptance criteria

• The module's affected dependencies are at or above their first patched versions, and its tests still pass.
• The open Dependabot alert count for this file is 0.
• The dependency updater proposes future updates for this module (or the reason it cannot is recorded here).

Effort: low. Coordinate with the open retirement work in this directory (platform#5044, #5041, #5045) to avoid conflicting edits.