fix: upgrade golang.org/x/net to v0.60.0

[chainloop-platform]

Summary

Upgraded the vulnerable golang.org/x/net dependency to v0.60.0 in the root module and the extras/dagger module. The extras/dagger module also picked up the minimum compatible Go and x/* dependency versions required by the patched release.

Vulnerability Fixed

GO-2026-6611-golang.org/x/net (HIGH): a malicious HTTP/2 peer can trigger excessive CPU consumption by sending many small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE updates.

Changes Made

• Bumped golang.org/x/net from v0.59.0 to v0.60.0 in the repository root go.mod and refreshed go.sum.
• Bumped golang.org/x/net from v0.58.0 to v0.60.0 in extras/dagger/go.mod and refreshed extras/dagger/go.sum.
• Accepted the minimal transitive updates in extras/dagger required by the patched module resolution: go 1.26.0, golang.org/x/sync v0.23.0, golang.org/x/sys v0.48.0, and golang.org/x/text v0.42.0.

Verification

Ran syft dir:. -o cyclonedx-json=sbom.json and GRYPE_DB_AUTO_UPDATE=false grype sbom:sbom.json --only-fixed -o json > grype2.json from repo/. Outcome: resolved. The resulting scan no longer reports GO-2026-6611-golang.org/x/net, and the generated SBOM resolves golang.org/x/net at v0.60.0 for both discovered Go modules.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⚠️ no AI session found

Missing AI Coding Sessions

This organization requires every PR to be backed by a Chainloop Trace AI coding session, and none was found for this one.

Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace