build(deps): bump the docker group across 6 directories with 5 updates

[dependabot]

Bumps the docker group with 1 update in the /postgresql directory: postgres.
Bumps the docker group with 1 update in the /rabbitmq directory: rabbitmq.
Bumps the docker group with 2 updates in the /sda-doa directory: maven and eclipse-temurin.
Bumps the docker group with 1 update in the /sda-download directory: golang.
Bumps the docker group with 2 updates in the /sda-sftp-inbox directory: maven and eclipse-temurin.
Bumps the docker group with 1 update in the /sda-validator/orchestrator directory: golang.

Updates postgres from 15.16-alpine3.23 to 18.3-alpine3.23

Updates rabbitmq from 3.12.13-management-alpine to 4.2.5-management-alpine

Updates maven from 3-eclipse-temurin-21-alpine to 3-eclipse-temurin-25-alpine

Updates eclipse-temurin from 21-jre-alpine to 25-jre-alpine

Updates maven from 3-eclipse-temurin-21-alpine to 3-eclipse-temurin-25-alpine

Updates eclipse-temurin from 21-jre-alpine to 25-jre-alpine

Updates golang from 1.25-alpine to 1.26-alpine

Updates golang from 1.25-alpine to 1.26-alpine

Updates maven from 3-eclipse-temurin-22-alpine to 3-eclipse-temurin-25-alpine

Updates eclipse-temurin from 21-alpine to 25-alpine

Updates maven from 3-eclipse-temurin-22-alpine to 3-eclipse-temurin-25-alpine

Updates eclipse-temurin from 21-alpine to 25-alpine

Updates golang from 1.25-alpine to 1.26-alpine

Updates golang from 1.25-alpine to 1.26-alpine

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

🔍 Trivy Scan - PostgresSQL 🔍

Target ghcr.io/neicnordic/sensitive-data-archive:PR2334-postgres (alpine 3.23.3)

Vulnerabilities (2)

Package	ID	Severity	Installed Version	Fixed Version	Title
zlib	CVE-2026-22184	HIGH	1.3.1-r2	1.3.2-r0	zlib: zlib: Arbitrary code execution via buffer overflow in untgz utility
zlib	CVE-2026-27171	MEDIUM	1.3.1-r2	1.3.2-r0	zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions

Target usr/local/bin/gosu

Vulnerabilities (19)

Package	ID	Severity	Installed Version	Fixed Version	Title
stdlib	CVE-2025-68121	CRITICAL	v1.24.6	1.24.13, 1.25.7, 1.26.0-rc.3	crypto/tls: Unexpected session resumption in crypto/tls
stdlib	CVE-2025-58183	HIGH	v1.24.6	1.24.8, 1.25.2	golang: archive/tar: Unbounded allocation when parsing GNU sparse map
stdlib	CVE-2025-61726	HIGH	v1.24.6	1.24.12, 1.25.6	golang: net/url: Memory exhaustion in query parameter parsing in net/url
stdlib	CVE-2025-61728	HIGH	v1.24.6	1.24.12, 1.25.6	golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip
stdlib	CVE-2025-61729	HIGH	v1.24.6	1.24.11, 1.25.5	crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate
stdlib	CVE-2026-25679	HIGH	v1.24.6	1.25.8, 1.26.1	net/url: Incorrect parsing of IPv6 host literals in net/url
stdlib	CVE-2025-47912	MEDIUM	v1.24.6	1.24.8, 1.25.2	net/url: Insufficient validation of bracketed IPv6 hostnames in net/url
stdlib	CVE-2025-58185	MEDIUM	v1.24.6	1.24.8, 1.25.2	encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1
stdlib	CVE-2025-58186	MEDIUM	v1.24.6	1.24.8, 1.25.2	golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http
stdlib	CVE-2025-58187	MEDIUM	v1.24.6	1.24.9, 1.25.3	crypto/x509: Quadratic complexity when checking name constraints in crypto/x509
stdlib	CVE-2025-58188	MEDIUM	v1.24.6	1.24.8, 1.25.2	crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509
stdlib	CVE-2025-58189	MEDIUM	v1.24.6	1.24.8, 1.25.2	crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information
stdlib	CVE-2025-61723	MEDIUM	v1.24.6	1.24.8, 1.25.2	encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem
stdlib	CVE-2025-61724	MEDIUM	v1.24.6	1.24.8, 1.25.2	net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto
stdlib	CVE-2025-61725	MEDIUM	v1.24.6	1.24.8, 1.25.2	net/mail: Excessive CPU consumption in ParseAddress in net/mail
stdlib	CVE-2025-61727	MEDIUM	v1.24.6	1.24.11, 1.25.5	golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs
stdlib	CVE-2025-61730	MEDIUM	v1.24.6	1.24.12, 1.25.6	During the TLS 1.3 handshake if multiple messages are sent in records ...
stdlib	CVE-2026-27142	MEDIUM	v1.24.6	1.25.8, 1.26.1	html/template: URLs in meta content attribute actions are not escaped in html/template
stdlib	CVE-2026-27139	LOW	v1.24.6	1.25.8, 1.26.1	os: FileInfo can escape from a Root in golang os module

[dependabot]

Superseded by #2408.