*: bump apache/thrift to v0.24.0, x/crypto to v0.56.0

[vtatai]

Fixes known CVEs in both dependencies. grpc bump to v1.83.1 is intentionally not included here: it requires otel v1.44.0, which is incompatible with go.etcd.io/etcd/server/v3's use of the removed otelgrpc.UnaryServerInterceptor API across all 3.5.x releases.

Verified: go build ./... compiles cleanly.

What problem does this PR solve?

Issue Number: None

github.com/apache/thrift (v0.23.0) and golang.org/x/crypto (v0.53.0) carry known CVEs that are fixed in later releases.

What is changed and how it works?

Bumps:

• github.com/apache/thrift v0.23.0 -> v0.24.0
• golang.org/x/crypto v0.53.0 -> v0.56.0

google.golang.org/grpc is intentionally left unchanged in this PR. Bumping grpc to v1.83.1 (the version needed to fix its own known CVEs) pulls in go.opentelemetry.io/otel v1.44.0 as a direct go.mod requirement. That breaks the build because go.etcd.io/etcd/server/v3 (every 3.5.x release) calls otelgrpc.UnaryServerInterceptor, an API removed in the otelgrpc version required by otel v1.44.0. Resolving that will need either an etcd 3.6.x migration or a patched etcd fork, and is tracked as separate follow-up work rather than bundled here.

Check List

Tests

• No code

Questions

Will it cause performance regression or break compatibility?

No. Both are backward-compatible patch/minor version bumps within the same major version; go build ./... compiles cleanly against the full module.

Do you need to update user documentation, design documentation or monitoring documentation?

No.

Release note

Fix potential security vulnerabilities by upgrading `apache/thrift` and `golang.org/x/crypto` dependencies.

Summary by CodeRabbit

• Chores
  • Updated the application’s Go toolchain and supporting libraries to newer versions.
  • Includes routine maintenance updates to networking, synchronization, system, terminal, text, security, telemetry, and development tooling components.
  • No user-facing features or behavior changes were introduced.

[ti-chi-bot]

This cherry pick PR is for a release branch and has not yet been approved by triage owners.
Adding the do-not-merge/cherry-pick-not-approved label.

To merge this cherry pick:

1. It must be LGTMed and approved by the reviewers firstly.
2. For pull requests to TiDB-x branches, it must have no failed tests.
3. AFTER it has lgtm and approved labels, please wait for the cherry-pick merging approval from triage owners.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b77cf7aa-2ef2-4f50-8669-97c407ba4648

📥 Commits

Reviewing files that changed from the base of the PR and between 07713a9 and 44f5336.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request raises the required Go toolchain version to 1.26.0 and updates selected direct and indirect dependencies in go.mod.

Changes

Go toolchain and dependency updates

Layer / File(s)	Summary
Go toolchain and dependency versions go.mod	The Go directive changes to 1.26.0. Selected golang.org/x/ and Apache Thrift dependencies use newer versions. Unchanged dependencies remain unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: ti-chi-bot

Merge Risk: ⚪ Minimal · up to 44f53

The PR updates the Go toolchain and selected dependencies without an identified merge-blocking behavior change.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the problem, dependency changes, compatibility impact, validation, documentation impact, and release note. However, the required issue reference is missing because it uses "Issu…	Create or identify the relevant issue, then replace "Issue Number: None" with a line that starts with "Issue Number: " and links the issue using "close" or "ref".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the two primary dependency upgrades in the pull request. The leading "*:" is unnecessary but does not make the title unclear.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description covers the problem, dependency changes, compatibility impact, validation, documentation impact, and release note. However, the required issue reference is missing because it uses "Issue Number: None" instead of linking an issue with "close" or "ref".

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the module gate
Go 1.26 arrives in state
New packages hop in line
Old unchanged pins still shine
The build burrow is neat and fine}

_{Comment @coderabbitai help to get the list of available commands.}

[ti-chi-bot]

Hi @vtatai. Thanks for your PR.

I'm waiting for a pingcap member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

@coderabbitai[bot]: adding LGTM is restricted to approvers and reviewers in OWNERS files.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: coderabbitai[bot]
Once this PR has been reviewed and has the lgtm label, please assign hicqu for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment