fix: upgrade golang.org/x/net to v0.60.0 for GO-2026-6610

[chainloop-platform]

Summary

Bumped golang.org/x/net to v0.60.0 in the root module and the extras/dagger module to remove the vulnerable HTTP/2 implementation flagged by GO-2026-6610. This keeps the change limited to the two manifests identified by the assessment and refreshes the corresponding module sums.

Vulnerability Fixed

GO-2026-6610-golang.org/x/net
Severity: HIGH
Historically lax handling of malformed HTTP/2 framing-related headers in golang.org/x/net/http2 could enable response smuggling when a Go service forwards HTTP/2 responses to HTTP/1 clients as a reverse proxy.

Changes Made

• Updated golang.org/x/net from v0.59.0 to v0.60.0 in go.mod, matching the assessed fixed version.
• Updated golang.org/x/net from v0.58.0 to v0.60.0 in extras/dagger/go.mod, which also carried the vulnerable indirect dependency.
• Regenerated go.sum and extras/dagger/go.sum so both modules include checksums for golang.org/x/net v0.60.0.

Verification

Ran syft dir:/workspace/run/repo -o cyclonedx-json=/tmp/chainloop-sbom-final.json >/dev/null && grype sbom:/tmp/chainloop-sbom-final.json --only-fixed -o json > /tmp/chainloop-grype-final.json against /workspace/run/repo. Outcome: resolved.

grype confirms GO-2026-6610-golang.org/x/net is absent from the patched repo SBOM after the golang.org/x/net bump.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⚠️ no AI session found

Missing AI Coding Sessions

This organization requires every PR to be backed by a Chainloop Trace AI coding session, and none was found for this one.

Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace