chore: upgrade golang.org/x/crypto to v0.56.0 to address CVE-2026-56855, CVE-2026-78662 (#1716)

* chore: upgrade golang.org/x/crypto to v0.56.0 in zoekt to address CVEs

Bumps the zoekt submodule and builds it with golang:1.26-alpine, since
x/crypto v0.56.0 requires Go 1.26.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: add CHANGELOG entry for #1716

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: point zoekt submodule at merged main

Includes sourcebot-dev/zoekt#29 (x/crypto v0.56.0) and sourcebot-dev/zoekt#28
(OpenTelemetry-Go exporters and SDK v1.45.0).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: brendan-kellam

CHANGELOG.md

@@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Upgraded `next` to `^16.3.8`. [#1709](https://github.com/sourcebot-dev/sourcebot/pull/1709)
 - Upgraded `seroval` to `^1.6.8`, `proxy-addr` to `^2.0.8`, `shell-quote` to `^1.12.0`, and `@grpc/grpc-js` to `^1.14.6`. [#1713](https://github.com/sourcebot-dev/sourcebot/pull/1713)
 - Upgraded `engine.io` to `^6.6.11`, `source-map-js` to `^1.2.2`, `smol-toml` to `^1.9.0`, `fast-copy` to `^3.1.0`, and `dompurify` to `^3.4.16`. [#1714](https://github.com/sourcebot-dev/sourcebot/pull/1714)
+- Upgraded `golang.org/x/crypto` to `v0.56.0` and OpenTelemetry-Go exporters and SDK to `v1.45.0` in Zoekt. [#1716](https://github.com/sourcebot-dev/sourcebot/pull/1716)
 
 ## [5.1.15] - 2026-09-29
 

Dockerfile

@@ -14,7 +14,7 @@ ARG NEXT_PUBLIC_SENTRY_BACKEND_DSN
 ARG NEXT_PUBLIC_BUILD_COMMIT_SHA
 
 FROM node:24-alpine3.23 AS node-alpine
-FROM golang:1.25-alpine AS go-alpine
+FROM golang:1.26-alpine AS go-alpine
 # ----------------------------------
 
 # ------ Build Zoekt ------