fix: upgrade Go toolchain to 1.27.2 for GO-2026-6608-stdlib

[chainloop-platform]

Summary

Bumped the repository Go toolchain declarations and release builder image pins from 1.27.1 to 1.27.2 so Chainloop no longer builds against the vulnerable stdlib release.

Vulnerability Fixed

GO-2026-6608-stdlib, HIGH: parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Changes Made

• Updated go.mod from go 1.27.1 to go 1.27.2 so the main module targets the patched Go release.
• Updated the Go builder image pins in app/controlplane/Dockerfile.goreleaser, app/cli/Dockerfile.goreleaser, and app/artifact-cas/Dockerfile.goreleaser from golang:1.27.1@sha256:1e93e00a31255c07e9a34c4207f3006e1501730c5323697cee7dfb827fdae44c to golang:1.27.2@sha256:007a316059246276cb214df93950be77837545dc78007a73e0291a4963d5d3bf so release builds use the patched stdlib.

Verification

Ran grype golang:1.27.2@sha256:007a316059246276cb214df93950be77837545dc78007a73e0291a4963d5d3bf --only-fixed -o json against the updated builder image digest and confirmed GO-2026-6608 / CVE-2026-94440 are absent; the scan returned zero matches. Also ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json in the patched repository, and the target advisory was not reported there either. Outcome: resolved.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⚠️ no AI session found

Missing AI Coding Sessions

This organization requires every PR to be backed by a Chainloop Trace AI coding session, and none was found for this one.

Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace