Backport of 'Update GitLab Elasticsearch Indexer to 5.14.14' to 19.3

🤖 AI-authored change.

What does this MR do and why?

Bumps GITLAB_ELASTICSEARCH_INDEXER_VERSION from 5.14.13 to 5.14.14 on 19-3-stable-ee, restoring jackc/pgx/v5 to 5.10.0 — above the 5.9.0 fixed line for CVE-2026-33816 (CVSS 9.8, out-of-bounds write from malicious database responses). The 5.14.13 pin moved the indexer's dependencies backwards: that tag was cut from the v5.14.7 lineage, not from main, so it ships pgx 5.8.0.

v5.14.14 is the union of both lineages, so one bump closes it with no cherry-picking.

	5.14.13 (now)	5.14.14
jackc/pgx/v5	5.8.0 — vulnerable	5.10.0
go	1.25.0	1.26.0

Also restored: x/crypto, x/net, grpc, a goroutine-leak fix, Debian base 13. The ICU charset-conversion fix 5.14.13 carried is kept.

Backport of !255533 (merged), which reached workflow::production on 2026-09-16.

Reviewer focus: the red e2e:test-on-cng bridge. It fails only on cng-secrets-manager, in two Secrets Management specs asserting a runner trace string; nothing on that path reads the indexer pin. e2e:test-on-omnibus-ee is green on this head.

MR acceptance checklist

• Backporting a fix previously merged in the default branch.
• The default-branch MR has been deployed to GitLab.com.
• The MR title is descriptive.
• Required labels applied.
  • Severity / bug subtype: not applicable — a dependency pin (type::maintenance).
  • ~"customer": not applicable — no customer-reported impact.
• Approved by a maintainer (one approval required).
• e2e:test-on-omnibus-ee has succeeded.

---

🤖 Automated change — mention me to get a response. Feedback welcome. Ask to speak to John directly anytime.

Mechanism, citations and verification (for agents / deep readers)

Mechanism

One line in GITLAB_ELASTICSEARCH_INDEXER_VERSION — 1 file changed, 1 insertion, 1 deletion. Omnibus and the GDK read that file to pick the gitlab-elasticsearch-indexer tag they build, so the pin is the whole delivery path.

Verification

Read from gitlab-org/gitlab-elasticsearch-indexer at each tag, via the repository files API:

• go.mod at v5.14.13: github.com/jackc/pgx/v5 v5.8.0, go 1.25.0. At v5.14.12 and v5.14.14: v5.10.0, go 1.26.0.
• Lineage: the merge base of v5.14.12 and v5.14.14 is v5.14.12's own tip, so v5.14.14 descends from it. The merge base of v5.14.12 and v5.14.13 is an earlier commit — v5.14.13 does not.
• Branch cut from origin/19-3-stable-ee; the MR diff names only GITLAB_ELASTICSEARCH_INDEXER_VERSION, and master already reads 5.14.14.
• Head pipeline 2856225759: 379 of 384 jobs green, 0 failed jobs, 3 manual, 2 skipped. e2e:test-on-omnibus-ee bridge success (downstream 2856237459 success). e2e:test-on-cng bridge failed on one job, cng-secrets-manager, whose trace ends 2 examples, 2 failures in project_secret_ci_access_failure_spec.rb and group_secret_ci_access_failure_spec.rb, both on expect(trace).to have_content('ERROR: Job failed (system failure)').
• Checklist evidence: approvals API reports approved: true by the maintainer who approved on 2026-09-16; the default-branch MR's label events show workflow::production added 2026-09-16.
• Advisories: GHSA-9jj7-4m8r-rfcm / GO-2026-4772 (CVE-2026-33816), GHSA-xgrm-4fwx-7qm8 (CVE-2026-33815).
• Patch release process: https://gitlab.com/gitlab-org/release/docs/-/blob/master/general/patch/engineers.md

What I did not verify

• No indexer binary was built from v5.14.14 against this branch; the dependency claim rests on tag contents and the pipeline.
• Whether any deployment has actually been reached through the vulnerable pgx path.
• Whether the two cng-secrets-manager failures are a known flake or a real product defect — I established only that the failing specs do not touch the indexer.
• Whether release managers want the ICU fix and the dependency restoration recorded as separate patch-release entries.