Backport of 'Update GitLab Elasticsearch Indexer to 5.14.14' to 19.1

🤖 AI-authored change.

What does this MR do and why?

Bumps GITLAB_ELASTICSEARCH_INDEXER_VERSION from 5.14.13 to 5.14.14 on 19-1-stable-ee, because the current 5.14.13 pin builds the indexer with jackc/pgx/v5 5.8.0 — below the 5.9.0 fixed line for CVE-2026-33816 (CVSS 9.8, out-of-bounds write from malicious database responses). v5.14.13 was cut from the v5.14.7 lineage rather than from main, so pinning it moved the indexer's dependencies backwards. pgx is a direct dependency, imported in indexer code.

v5.14.14 is cut from main and is the union of both lineages: pgx 5.10.0 and go 1.26.0 restored, ICU charset-conversion fix (sirt_7308) kept. Also restored: x/crypto 0.52.0, x/net 0.55.0, grpc 1.80.0, a goroutine-leak fix, Debian base image 13.

Same change as 19.4 (!255771 (merged), merged), 19.2 (!255783 (merged), merged) and 19.3 (!255782 (merged), open). Requested by @mayra-cabrera in the release thread.

Follows !255533 (merged)

MR acceptance checklist

• This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
• The MR that fixed the bug on the default branch has been deployed to GitLab.com.
• The MR title is descriptive (e.g. "Backport of 'title of default branch MR'").
• Required labels have been applied to this merge request
  • severity label and bug subtype labels (if applicable)
  • If this MR fixes a bug that affects customers, the customer label has been applied.
• This MR has been approved by a maintainer (only one approval is required).
• Ensure the e2e:test-on-omnibus-ee job has succeeded, or if it has failed, investigate the failures.

Note to the merge request author and maintainer

See the patch release runbook for the process, and #releases for questions.

---

🤖 Automated change — mention me to get a response. Feedback welcome. Ask to speak to John directly anytime.

Mechanism, citations and verification (for agents / deep readers)

Mechanism

One line in GITLAB_ELASTICSEARCH_INDEXER_VERSION. Omnibus and the GDK read that file to pick the gitlab-elasticsearch-indexer tag they build, so the pin is the whole delivery path.

Verification

• Branch cut from 19-1-stable-ee at 3b0afd87. Commit c2e73c47 diff: one file, -5.14.13 / +5.14.14.
• go.mod read from the indexer repo at each tag: v5.14.13 → go 1.25.0, github.com/jackc/pgx/v5 v5.8.0; v5.14.14 → go 1.26.0, github.com/jackc/pgx/v5 v5.10.0.
• third_party/icu/ (the sirt_7308 vendored fix) present at v5.14.14.
• 19.1 was on 5.14.5 before 7bef876b moved it to 5.14.13 on 2026-09-09; v5.14.14 carries everything on the 5.14.5 → 5.14.12 line plus the fix, so nothing 19.1 previously shipped is dropped.
• Advisories: GHSA-9jj7-4m8r-rfcm / GO-2026-4772 (CVE-2026-33816), GHSA-xgrm-4fwx-7qm8 (CVE-2026-33815).

What I did not verify

• No indexer binary was built from v5.14.14 against this branch; the pipeline on this MR is the gate.
• Whether 19.1 is still inside the patch-release window for this cycle; release managers asked for it, so that call is theirs.