fix(container): cut image vulnerabilities with x dep bumps and base image refresh

[Sahilb315]

Context

A user integrating ghcr.io/safedep/pmg:latest into their Dockerfile reported a Grype scan with 23 critical, 112 high and 124 medium findings (370 total). Root causes:

• The runtime base was debian:11-slim (bullseye), digest pinned since May 2025. Bullseye is out of standard security support and ships EOL components (OpenSSL 1.1.1, Perl 5.32). 270 of the 370 findings came from these OS packages.
• The golang:1.25-bookworm builder digest was stale and carried go1.25.5, seven patch releases behind: 61 findings against the Go stdlib embedded in the binary.
• golang.org/x modules were behind (x/crypto v0.49.0, x/net v0.51.0): 37 findings.

Changes

• Bump golang.org/x/crypto to v0.54.0, x/net to v0.57.0, x/sys to v0.47.0, x/text to v0.40.0 (x/mod, x/sync, x/term follow via MVS). All of these run on the Go 1.25 line.
• Move the runtime base to debian:13-slim (current stable) with a fresh digest pin.
• Refresh the golang:1.25-bookworm digest pin. The current digest carries go1.25.12, which includes every stdlib CVE fix flagged in the scan.

Deliberately unchanged, see #390:

• The go directive stays 1.25.1. The 1.26 move is blocked on goproxy (Fix unexpected scheme edge case in MITM elazarl/goproxy#793): Go 1.26 net/url rejects the malformed absolute-form URLs goproxy reconstructs during MITM. Keeping the directive on 1.25 sidesteps the behavior change entirely, since GODEBUG defaults follow the main module directive.
• grpc stays pinned at v1.81.0 due to the analyzer trailers regression with v1.82.x; the upstream fix (transport: surface data when received non-grpc header, end stream without trailers grpc/grpc-go#9217) is milestoned for 1.84. This leaves one known High (GHSA-hrxh-6v49-42gf) in the image.
• A distroless static runtime base would take OS findings to zero; deferred as a separate decision.

Results

Grype on the image built from this branch: 370 findings drop to 165 (criticals 23 to 7, highs 112 to 20). The pmg binary itself: 100 findings drop to 1 (the pinned grpc High). Every remaining OS finding is wont-fix or not-fixed triage by Debian in essential trixie packages (perl-base, glibc, ncurses); no package upgrade clears them.

Verified locally: go build ./..., full go test ./... (proxy e2e suite green; one pre-existing Seatbelt golden failure reproduces identically on a clean tree), docker build, pmg version inside the built image, and Grype scans of both the binary and the image.

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
golang.org/x/crypto @ 0.54.0 go.mod scripts/go.mod				🔗
golang.org/x/mod @ 0.37.0 go.mod				🔗
golang.org/x/net @ 0.57.0 go.mod				🔗
golang.org/x/sync @ 0.22.0 go.mod				🔗
golang.org/x/sys @ 0.47.0 go.mod scripts/go.mod				🔗
golang.org/x/term @ 0.45.0 go.mod				🔗
golang.org/x/text @ 0.40.0 go.mod scripts/go.mod				🔗

View complete scan results →

_{This report is generated by SafeDep Github App}

[github-actions]

vet Summary Report

This report is generated by vet

Policy Checks

• ✅ Vulnerability
• ✅ Malware
• ✅ License
• ✅ Popularity
• ✅ Maintenance
• ✅ Security Posture
• ✅ Threats

Malicious Package Analysis

Malicious package analysis was performed using SafeDep Cloud API

Malicious Package Analysis Report

Ecosystem	Package	Version	Status	Report

• ℹ️ 0 packages have been actively analyzed for malicious behaviour.
• ✅ No malicious packages found.

Note: Some of the package analysis jobs may still be running.Please check back later. Consider increasing the timeout for better coverage.

Changed Packages

Changed Packages

• ✅ [Go] golang.org/x/sys@0.47.0
• ✅ [Go] golang.org/x/text@0.40.0
• ✅ [Go] golang.org/x/mod@0.37.0
• ✅ [Go] golang.org/x/sync@0.22.0
• ✅ [Go] golang.org/x/crypto@0.54.0
• ✅ [Go] golang.org/x/term@0.45.0
• ✅ [Go] golang.org/x/net@0.57.0

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.64%. Comparing base (47dd859) to head (5fa3ef2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #394   +/-   ##
=======================================
  Coverage   58.64%   58.64%           
=======================================
  Files         222      222           
  Lines       15276    15276           
=======================================
  Hits         8958     8958           
  Misses       5503     5503           
  Partials      815      815           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.