fix: remediate GO-2026-5026 in extras/dagger
Summary
Updated the optional extras/dagger module to resolve golang.org/x/net to v0.55.0, the first fixed release for this advisory. Because v0.55.0 requires Go 1.25, the submodule's Go version and companion x/* indirect modules were raised by Go's module resolver.
Vulnerability Fixed
GO-2026-5026-golang.org/x/net (HIGH): the idna package accepted certain Punycode labels that decode to ASCII-only labels, which can bypass hostname-based privilege checks.
Changes Made
- Bumped extras/dagger/go.mod from golang.org/x/net v0.44.0 to v0.55.0, the lowest fixed release in the assessment hint.
- Accepted the accompanying indirect upgrades to golang.org/x/sync, golang.org/x/sys, and golang.org/x/text, plus the extras/dagger go directive bump to 1.25.0, because golang.org/x/net v0.55.0 requires Go 1.25.
- Refreshed extras/dagger/go.sum to record the patched module graph.
Verification
Ran syft dir:. -o cyclonedx-json=<tempfile> && grype sbom:<tempfile> --only-fixed -o json from the repository root. Outcome: resolved — GO-2026-5026-golang.org/x/net and golang.org/x/net no longer appear in the scan results after the bump. The scan still reports unrelated fixed vulnerabilities in other extras/dagger dependencies.