fix: remediate GO-2026-5942-golang.org/x/net in extras/dagger
Summary
Updated the auxiliary extras/dagger Go module to use golang.org/x/net v0.56.0, the first fixed release for this advisory. This also refreshes the transitive golang.org/x/sys checksum data to match the resolved module graph.
Vulnerability Fixed
GO-2026-5942-golang.org/x/net (HIGH) — Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
Changes Made
-
Bumped
extras/dagger/go.modfromgolang.org/x/net v0.55.0tov0.56.0to pick up the fix for the panic in malformed SVCB/HTTPS RR parsing. -
Updated
extras/dagger/go.sumwith the newgolang.org/x/net v0.56.0checksums and the transitivegolang.org/x/sys v0.46.0checksums pulled in by the module resolution.
Verification
Ran syft dir:. -o cyclonedx-json=/tmp/remediate/sbom.json && grype sbom:/tmp/remediate/sbom.json --only-fixed -o json from the repository root against the patched source tree. Outcome: resolved — the SBOM includes golang.org/x/net@v0.56.0, and grype no longer reports GO-2026-5942-golang.org/x/net.