fix: remediate GO-2026-6611-stdlib in Go builds

[chainloop-platform]

Summary

Updated the repository Go toolchain and release builder images from 1.27.1 to 1.27.2, and bumped golang.org/x/net to v0.60.0 in both Go modules so the HTTP/2 CPU exhaustion vulnerability is no longer present in the scanned source tree.

Vulnerability Fixed

GO-2026-6611-stdlib / CVE-2026-78669 (HIGH): a malicious HTTP/2 peer can trigger excessive CPU consumption by opening many streams and sending repeated SETTINGS_INITIAL_WINDOW_SIZE updates.

Changes Made

• Bumped the root module go directive from 1.27.1 to 1.27.2 in go.mod.
• Updated the goreleaser builder images in app/controlplane/Dockerfile.goreleaser, app/artifact-cas/Dockerfile.goreleaser, and app/cli/Dockerfile.goreleaser to golang:1.27.2@sha256:007a316059246276cb214df93950be77837545dc78007a73e0291a4963d5d3bf.
• Upgraded indirect golang.org/x/net dependencies to v0.60.0 in go.mod and extras/dagger/go.mod; the extras/dagger module also required the corresponding transitive updates recorded in extras/dagger/go.sum.
• Refreshed go.sum entries needed for the patched Go module graph.

Verification

Ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json against the patched repository root. Outcome: resolved — GO-2026-6611-stdlib / GO-2026-6611 / CVE-2026-78669 is no longer reported by grype for the scanned source tree.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⚠️ no AI session found

Missing AI Coding Sessions

This organization requires every PR to be backed by a Chainloop Trace AI coding session, and none was found for this one.

Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace