SUSE-SU-2026:21756-1

This update for mcphost fixes the following issues

• CVE-2025-30153: github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter (bsc#1264762).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1265274).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1265275).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253952).
• CVE-2026-32285: github.com/buger/jsonparser: denial of service via malformed JSON input (bsc#1264759).
• CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260224).

Changes for mcphost:

• Updated to version 0.34.0

• Features:

• Upgrade charmbracelet libs to v2 (bubbletea, lipgloss, bubbles)
• Add Google Vertex AI support for Claude models
• Add new models.

• Fixes:

• Eliminate escape sequence leak from spinner tea.Program instances.
• Fix anthropic api issue.
• Convert JSON Schema draft-07 exclusive bounds to draft-04 format.

• Upgrade all dependencies to latest versions, resolve security issues and to obtain Go 1.26 compatibility.