Bump the all-deps group across 1 directory with 3 updates

[dependabot]

Bumps the all-deps group with 2 updates in the / directory: github.com/caddyserver/certmagic and github.com/nats-io/nats-server/v2.

Updates github.com/caddyserver/certmagic from 0.25.3 to 0.25.4

Commits

• cf6f57d handshake: propagate leader load/obtain outcome to all waiters (#387)
• 7475593 Fix jm.names and jm.activeWorkees leak (#385)
• 9f98c96 Preserve DNS provider record data for cleanup (#382)
• 49b3509 ocsp: add responder authorization regression test (#383)
• 9b6be22 Support listening on file descriptors (#380)
• See full diff in compare view

Updates github.com/nats-io/nats-server/v2 from 2.14.2 to 2.14.3

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.14.3

Changelog

Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

Go Version

• 1.26.4 (#8281)

Dependencies

• golang.org/x/crypto v0.53.0 (#8297)
• golang.org/x/sys v0.46.0 (#8297)
• github.com/nats-io/jwt/v2 v2.8.2
• github.com/nats-io/nkeys v0.4.16

Improved

General

• Per-connection log lines that could be noisy in normal operation have been demoted to debug level (#8289)
• Writer options are now applied consistently when using the s2_fast compression mode (#8047)

JetStream

• Stream and consumer assignment handling has been refactored for more consistent migration and info behavior (#8262)
• Meta, stream and consumer write errors are now registered more consistently for health and recovery handling (#8293)

Removed

Monitoring

• JSONP callback support has been removed from monitoring endpoints

Fixed

General

• Long-running reconnect and OCSP loops no longer retain unused timers, reducing memory pressure over time (#8204)
• Inherited JWT default permissions are now refreshed when account claims are updated (#8276)
• External auth configuration is now cleared correctly when account claims are updated (#8275)
• PROXY protocol detection, TLS sniffing with allow_non_tls and PROXY v1 address-family parsing have been fixed (#8302)
• A race in gateway CONNECT handling has been fixed (#8306)
• Trusted proxy tracking no longer leaks closed clients during concurrent updates (#8307)
• Service import replies can now be delivered across cluster routes (#8317)
• Message tracing now works correctly with service imports and exports
• Several panic, fatal and data race conditions in authentication, routing, monitoring and clustered request handling have been fixed
• NoAuthUser now checks connection restrictions
• Leaf connections no longer bypass Nats-Trace-Dest publish permission checks
• CONNZ and SUBSZ pagination now guard against Offset and Limit integer overflow panics

... (truncated)

Commits

• 9b17a58 Release v2.14.3
• 2be2525 Release v2.14.3-RC.2
• 563d55f Cherry-picks for v2.14.3-RC.2 (#126)
• e242ca0 NRG: Don't campaign with an uncommitted membership change about ourselves
• 0e4d935 NRG: Exclude uncommitted membership change from snapshot
• 0ab7302 NRG: Remove redundant known peer tracking
• 6eb7d76 NRG: Truncated uncommitted membership change leaves stale state
• 8157b56 [TEST] Campaign early on NRG tests
• 712b3d2 [FIXED] Nil pointer panic when resolver dir parent is not traversable
• f11c26b [FIXED] Skipped messages set last time to now
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits

• 45460e0 go.mod: update golang.org/x dependencies
• d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
• e2ffffe ssh: reject incomplete gssapi-with-mic configurations
• 60e158a ssh/test: isolate CLI tests from user SSH config and agent
• 1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
• 3872a2b ssh/knownhosts: verify declared key type matches decoded key
• 9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
• 8f405a4 ssh: validate ECDSA curve matches expected algorithm
• bb41b3d ssh: improve DH GEX group selection using PreferredBits
• e04e721 ssh/agent: validate ed25519 private key length in Add
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.