fix: upgrade extras/dagger golang.org/x/net to v0.60.0

[chainloop-platform]

Summary

Upgraded the extras/dagger module from golang.org/x/net v0.58.0 to v0.60.0, the lowest fixed release identified by the assessment. This also refreshed the required transitive golang.org/x/{sync,sys,text} pins and the module go directive to satisfy the patched x/net release.

Vulnerability Fixed

GO-2026-6610-golang.org/x/net (HIGH): malformed HTTP/2 framing-related headers could be forwarded through an HTTP/2 to HTTP/1 reverse-proxy path and enable response smuggling.

Changes Made

• Updated extras/dagger/go.mod to require golang.org/x/net v0.60.0, replacing the vulnerable v0.58.0 pin identified in the assessment.
• Refreshed the corresponding extras/dagger/go.sum entries and the transitive golang.org/x/sync, golang.org/x/sys, and golang.org/x/text versions required by x/net v0.60.0.
• Accepted the go 1.26.0 directive change in extras/dagger/go.mod because the upstream golang.org/x/net v0.60.0 module itself declares go 1.26.0.

Verification

Ran GRYPE_DB_AUTO_UPDATE=false syft dir:. -o cyclonedx-json=/tmp/... && GRYPE_DB_AUTO_UPDATE=false grype sbom:/tmp/... --only-fixed -o json against repo/extras/dagger. Outcome: resolved — the scan no longer reports GO-2026-6610-golang.org/x/net for the patched module. Grype still reports unrelated fixed OpenTelemetry advisories in extras/dagger, but not the targeted golang.org/x/net issue.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⏭️ bypassed by label

AI Coding Session Check Bypassed

This PR carries the skip-ai-session label, so the AI coding session check was bypassed.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace

[migmartri]

This doesn't build, can we upgrade the engine?