fix: upgrade golang.org/x/net to v0.60.0

[chainloop-platform]

Summary

Upgraded golang.org/x/net to v0.60.0 in the root module and the extras/dagger submodule to remove the vulnerable HTTP/2 trailer handling implementation. The extras/dagger module also picked up the minimum related Go module updates required by golang.org/x/net v0.60.0.

Vulnerability Fixed

GO-2026-6603-golang.org/x/net (HIGH): HTTP/2 servers using golang.org/x/net/http2 could be forced to allocate excessive memory from attacker-controlled Trailer header declarations.

Changes Made

• Bumped golang.org/x/net from v0.59.0 to v0.60.0 in the root [go.mod].
• Bumped golang.org/x/net from v0.58.0 to v0.60.0 in extras/dagger/go.mod and refreshed go.sum entries.
• Accepted the minimal transitive updates required in extras/dagger (go 1.26.0, golang.org/x/sys v0.48.0, golang.org/x/text v0.42.0, golang.org/x/sync v0.23.0) because golang.org/x/net v0.60.0 declares go 1.26.0 and newer x/* dependencies.

Verification

Ran targeted manifest scans with GRYPE_DB_AUTO_UPDATE=false GRYPE_CHECK_FOR_APP_UPDATE=false syft scan file:go.mod -q -o json | GRYPE_DB_AUTO_UPDATE=false GRYPE_CHECK_FOR_APP_UPDATE=false grype --only-fixed -q in the repository root and in extras/dagger. Outcome: resolved — the root scan reported No vulnerabilities found, and the extras/dagger scan did not report GO-2026-6603-golang.org/x/net (it only surfaced unrelated fixed vulnerabilities).

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⏭️ bypassed by label

AI Coding Session Check Bypassed

This PR carries the skip-ai-session label, so the AI coding session check was bypassed.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace