Fix critical Go CVEs from daily vulnerability scan

[kylos101]

Summary

The latest scheduled main build reported two new CRITICAL Go advisories across production artifacts. This PR fixes those Go findings without duplicating the independent npm remediations already open in #21633, #21634, and #21635.

Root cause	From	To	Advisory
Go toolchain / stdlib	1.25.9–1.26.8	1.26.9	GO-2026-6604, GO-2026-6612
golang.org/x/net	0.55.0 / 0.58.0	0.60.0	GO-2026-6612
Docker CLI	29.5.3 (Go 1.26.4)	29.9.0 (Go 1.26.9)	GO-2026-6604, GO-2026-6612

The remediation:

• updates all 60 repository modules pinned to x/net 0.55.0 and the related golang.org/x/* dependency set;
• pins the development image and Dev Container to Go 1.26.9;
• bootstraps Go 1.26.9 in both mirrored build workflows until the rebuilt development image is promoted;
• rebuilds the Caddy, BuildKit, CNI, runc, and Git LFS binaries with the fixed compiler and dependency;
• updates the bundled Docker CLI to a release built with Go 1.26.9.

Existing npm remediation

The same scheduled scan still includes npm findings handled by these existing draft PRs:

• proxy-addr / GHSA-jqcg-44mw-7w3h: Fix critical proxy-addr CVE from daily vulnerability scan #21633
• shell-quote / GHSA-pqg4-j6r4-53mv: Fix critical shell-quote CVE from daily vulnerability scan #21634
• handlebars / GHSA-8r5x-fm3f-whwj, GHSA-p8wg-vrv2-v86f: Fix critical Handlebars CVEs from daily vulnerability scan #21635

Validation

• Built the BuildKit/CNI/runc and ws-daemon runc/Git LFS tool stages with Go 1.26.9.
• Built both standard and plugin-enabled Caddy binaries with Go 1.26.9 and x/net 0.60.0.
• Grype: zero GO-2026-6604 or GO-2026-6612 matches in all changed Go modules and rebuilt helper binaries.
• go build ./... passed in 19 key production modules.
• go test ./... passed for ws-proxy and image-builder-bob; all common-go packages except baseserver passed. The excluded baseserver test could not bind its hard-coded 127.0.0.1:8765 because that port is already occupied in this environment.
• pre-commit run --files <changed files>
• git diff --check

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​golang.org/​x/​crypto@​v0.57.0
	golang/​golang.org/​x/​net@​v0.55.0 ⏵ v0.60.0
	golang/​golang.org/​x/​sys@​v0.46.0 ⏵ v0.48.0	+1
	golang/​golang.org/​x/​sync@​v0.20.0 ⏵ v0.23.0	+1
	golang/​golang.org/​x/​term@​v0.43.0 ⏵ v0.46.0	+1

View full report