fix: bump extras/dagger Go toolchain for GO-2026-6617-stdlib
CH
12h ago+1+1+0123456789-1-1-0123456789
Summary
Bump the Dagger helper module's Go toolchain directive from 1.26.1 to 1.26.9 so its stdlib metadata no longer points at a vulnerable release line. The production root module was already on Go 1.27.2, so this is the smallest change needed to remove the stale vulnerable toolchain declaration.
Vulnerability Fixed
GO-2026-6617-stdlib (HIGH): HTTP/2 servers can crash if concurrent HPACK encoder updates race while handling SETTINGS_HEADER_TABLE_SIZE changes from a client.
Changes Made
- Updated
extras/dagger/go.modfromgo 1.26.1togo 1.26.9, the first fixed release identified for the Go 1.26 line. - Left the root module unchanged because
go.modalready pins Go 1.27.2, which the assessment identified as fixed. - Kept the remediation scoped to the Dagger helper module because its stale Go directive was the only remaining vulnerable toolchain declaration in the repository.
Verification
Ran syft dir:. -o cyclonedx-json=- | grype sbom:- --only-fixed -o json from the repository root against the patched source tree. Outcome: resolved for GO-2026-6617-stdlib, which is no longer reported in the SBOM scan after the extras/dagger/go.mod toolchain bump.