fix: upgrade golang.org/x/net to v0.60.0 for GO-2026-6610
Summary
Bumped golang.org/x/net to v0.60.0 in the root module and the extras/dagger module to remove the vulnerable HTTP/2 implementation flagged by GO-2026-6610. This keeps the change limited to the two manifests identified by the assessment and refreshes the corresponding module sums.
Vulnerability Fixed
GO-2026-6610-golang.org/x/net
Severity: HIGH
Historically lax handling of malformed HTTP/2 framing-related headers in golang.org/x/net/http2 could enable response smuggling when a Go service forwards HTTP/2 responses to HTTP/1 clients as a reverse proxy.
Changes Made
- Updated
golang.org/x/netfromv0.59.0tov0.60.0ingo.mod, matching the assessed fixed version. - Updated
golang.org/x/netfromv0.58.0tov0.60.0inextras/dagger/go.mod, which also carried the vulnerable indirect dependency. - Regenerated
go.sumandextras/dagger/go.sumso both modules include checksums forgolang.org/x/net v0.60.0.
Verification
Ran syft dir:/workspace/run/repo -o cyclonedx-json=/tmp/chainloop-sbom-final.json >/dev/null && grype sbom:/tmp/chainloop-sbom-final.json --only-fixed -o json > /tmp/chainloop-grype-final.json against /workspace/run/repo. Outcome: resolved.
grype confirms GO-2026-6610-golang.org/x/net is absent from the patched repo SBOM after the golang.org/x/net bump.