fix(controlplane): remediate migrations image and moby/moby vulnerabilities

Merged
MI
4mo ago
+7-11

Summary

Remediates the vulnerability policy violations flagged for chainloop v1.100.7.

  • Bumps the arigaio/atlas base image in the control-plane migrations Dockerfile to a build with an updated Go toolchain and golang.org/x/crypto / golang.org/x/net, resolving 13 vulnerabilities (7 critical, 6 high) in the migrations image.
  • Removes the github.com/moby/moby dependency, which was pulled in only for its pkg/namesgenerator helper used to generate random organization names in test setups. That legacy +incompatible import path carried 5 high-severity advisories in unrelated daemon/engine code and has no fixed version available. The helper is replaced with a short UUID-based prefix, eliminating the dependency and all 5 advisories.

AI assistance

This change was produced with the assistance of Claude Code.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri