fix: remediate GO-2026-5942-stdlib

Merged
CH
2mo ago
+6-4

Summary

Upgraded the repository's Go toolchain pins from 1.26.5 to 1.26.6 and refreshed the goreleaser builder image digests to the patched golang:1.26.6 image. A follow-up SBOM scan also surfaced the same advisory ID on golang.org/x/net in extras/dagger, so that submodule dependency was bumped to v0.56.0 to fully clear the finding.

Vulnerability Fixed

GO-2026-5942-stdlib (HIGH): parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Changes Made

  • Updated go.mod from go 1.26.5 to go 1.26.6, the first patched stdlib release for this advisory.
  • Updated app/controlplane/Dockerfile.goreleaser, app/cli/Dockerfile.goreleaser, and app/artifact-cas/Dockerfile.goreleaser to golang:1.26.6@sha256:640a234f4bea3e399c056b7b8f9c667c4939befae8db2f14e9785e16eccd4205.
  • Updated extras/dagger/go.mod to use golang.org/x/net v0.56.0 and refreshed extras/dagger/go.sum after the repo SBOM scan showed the same advisory ID there.

Verification

Ran syft dir:. -o cyclonedx-json=sbom.json && GRYPE_DB_AUTO_UPDATE=false grype sbom:sbom.json --only-fixed -o json from repo/; outcome: resolved. The final SBOM scan no longer reports GO-2026-5942 or CVE-2026-46600.

Ran GRYPE_DB_AUTO_UPDATE=false grype golang@sha256:640a234f4bea3e399c056b7b8f9c667c4939befae8db2f14e9785e16eccd4205 --only-fixed -o json; outcome: resolved. Grype confirms the patched golang:1.26.6 builder image digest no longer reports the target vulnerability.

Risk Assessment

View the risk assessment in Chainloop