fix: upgrade Go toolchain and x/net to resolve GO-2026-6610-stdlib

[chainloop-platform]

Summary

Updated the main Go toolchain, the release builder image pins, and the affected golang.org/x/net dependencies so the repository no longer reports GO-2026-6610 in SBOM-based scanning. The extras/dagger module was updated as well because it independently pinned the vulnerable golang.org/x/net release.

Vulnerability Fixed

GO-2026-6610-stdlib (HIGH): malformed HTTP/2 framing-related headers could be forwarded in a way that enables response smuggling when vulnerable transport code is used.

Changes Made

• Bumped the root module Go version from 1.27.1 to 1.27.2 in go.mod.
• Upgraded golang.org/x/net from v0.59.0 to v0.60.0 in the root module to pick up the fixed HTTP/2 transport implementation.
• Upgraded extras/dagger from golang.org/x/net v0.58.0 to v0.60.0; the resolver also advanced related indirect modules (golang.org/x/sync, golang.org/x/sys, golang.org/x/text) and raised its go directive to 1.26.0.
• Updated the three goreleaser builder Dockerfiles from golang:1.27.1 to golang:1.27.2 using the published sha256:007a316059246276cb214df93950be77837545dc78007a73e0291a4963d5d3bf digest so release builds use the fixed toolchain.

Verification

Ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json against the patched repository root. Outcome: resolved — GO-2026-6610 / GO-2026-6610-stdlib is no longer present in the grype results for the generated SBOM.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⚠️ no AI session found

Missing AI Coding Sessions

This organization requires every PR to be backed by a Chainloop Trace AI coding session, and none was found for this one.

Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace