fix: upgrade golang.org/x/net to v0.60.0
Summary
Upgraded golang.org/x/net to v0.60.0 in the root module and extras/dagger to remove the vulnerable HTTP/2 trailer parsing code path flagged by GO-2026-6603. The nested extras/dagger module also needed its Go directive and transitive x/* dependencies refreshed to satisfy the patched module's requirements.
Vulnerability Fixed
GO-2026-6603-golang.org/x/net (HIGH): golang.org/x/net/http2 can allocate disproportionate memory from malicious Trailer headers on HTTP/2 servers, enabling denial of service.
Changes Made
- Bumped
golang.org/x/netfromv0.59.0tov0.60.0ingo.modand refreshedgo.sum. - Bumped
golang.org/x/netfromv0.58.0tov0.60.0inextras/dagger/go.modand refreshedextras/dagger/go.sum. - Updated
extras/dagger/go.mod's Go directive to1.26.0and refreshed indirectgolang.org/x/sys,golang.org/x/text, andgolang.org/x/syncentries required by the patched module graph.
Verification
Ran syft dir:/workspace/run/repo -o cyclonedx-json=/workspace/run/sbom.json && grype sbom:/workspace/run/sbom.json --only-fixed -o json > /workspace/run/grype.json against the patched repository. Verification outcome: resolved — grype no longer reports GO-2026-6603-golang.org/x/net for the scanned SBOM.