fix: upgrade golang.org/x/net to v0.60.0

[chainloop-platform]

Summary

Updated the root Go module and the stale extras/dagger module pin from golang.org/x/net v0.59.0/v0.58.0 to v0.60.0 to resolve the HTTP/2 CPU exhaustion advisory.

Vulnerability Fixed

GO-2026-6611-golang.org/x/net (HIGH): a malicious HTTP/2 peer can drive excessive CPU consumption by opening many streams and repeatedly sending small SETTINGS_INITIAL_WINDOW_SIZE frames.

Changes Made

• Bumped golang.org/x/net to v0.60.0 in the root module manifest and checksum file.
• Bumped the stale extras/dagger golang.org/x/net pin and checksum entries to v0.60.0 so the submodule no longer reports the vulnerable version.
• Kept the remediation scoped to dependency metadata only; no source changes were required.

Verification

Ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json against the patched repository root. Outcome: resolved — grype no longer reports GO-2026-6611-golang.org/x/net, and it reported no remaining golang.org/x/net matches in the generated SBOM scan.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⚠️ no AI session found

Missing AI Coding Sessions

This organization requires every PR to be backed by a Chainloop Trace AI coding session, and none was found for this one.

Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace