postgres-ai/database-lab v4.1.4 on GitLab

Security

Engine: bump the Go toolchain to 1.26.7 and golang.org/x/mod to v0.40.0, and digest-pin the rds-refresh Alpine base image (!1183)
Engine: bump golang.org/x/crypto to v0.55.0 (!1184)
Engine: track the docker-cli 29.x series instead of an exact -rN pin, so image rebuilds pick up upstream security releases (!1152, !1186)
CE UI: bump cypress to 15.x, which drops the extract-zip and enquirer advisories that had no upstream fix (!1184)
CE UI: refresh the pnpm overrides for dompurify, qs, nanoid and @babel/core (!1184)
CE UI: add the postcss, brace-expansion, form-data, tmp, fast-uri, immutable, js-yaml and ws overrides (!1186)
CE UI: pin vite to 6.4.3, fixing a server.fs.deny bypass and an NTLMv2 hash disclosure through launch-editor (!1186)

CI: install google-cloud-cli instead of the retired google-cloud-sdk package, which no longer resolves on Debian trixie (!1183)