fix: upgrade Go toolchain to 1.27.2 for GO-2026-6613-stdlib

[chainloop-platform]

Summary

Upgraded the repository Go toolchain from 1.27.1 to 1.27.2 and refreshed the pinned Go builder images to the corresponding 1.27.2 digest. This removes the vulnerable stdlib release affected by GO-2026-6613-stdlib from the main build paths.

Vulnerability Fixed

GO-2026-6613-stdlib, HIGH: the Go HTTP/1 server could continue parsing HTTP after a successful CONNECT response instead of treating the connection as a tunnel, enabling request smuggling through an intermediary proxy.

Changes Made

• Updated the root toolchain pin in go.mod from go 1.27.1 to go 1.27.2.
• Updated the Go builder image in app/controlplane/Dockerfile.goreleaser from golang:1.27.1 to golang:1.27.2 and refreshed the pinned digest.
• Updated the Go builder image in app/artifact-cas/Dockerfile.goreleaser from golang:1.27.1 to golang:1.27.2 and refreshed the pinned digest.
• Updated the Go builder image in app/cli/Dockerfile.goreleaser from golang:1.27.1 to golang:1.27.2 and refreshed the pinned digest so the shipped CLI image is rebuilt with the patched stdlib as well.

Verification

Ran syft dir:. -o cyclonedx-json=/tmp/chainloop-sbom.json && grype sbom:/tmp/chainloop-sbom.json --only-fixed -o json against the patched repo/ tree. Outcome: resolved — grype no longer reports GO-2026-6613-stdlib in the generated SBOM for the repository.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⏭️ bypassed by label

AI Coding Session Check Bypassed

This PR carries the skip-ai-session label, so the AI coding session check was bypassed.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace