[devantler]

🤖 Generated by the Agentic Engineer

Why

The platform's deployment and CI tools are built with a Go release and a networking library that have known security advisories. Fixed releases of both are available, and two sibling repositories already moved to them.

What

Build the platform's own tools with the fixed Go release and the fixed networking library. Tool behaviour does not change. The separately pinned rendering tool keeps its audited build on purpose.

🤖 Generated with Claude Code

Fixes #4684

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Validation at head aae32980e13d3a3fab0cd48f47901ae83b2df935

• Change: the root module's go directive moves from 1.26.6 to 1.26.9, the latest 1.26 patch release on go.dev. golang.org/x/net moves from 0.58.0 to 0.60.0, and with it golang.org/x/sys (0.48.0) and golang.org/x/text (0.42.0) as x/net's minimums. go.sum carries the matching checksums, plus golang.org/x/tools 0.49.0, which x/net 0.60.0's module graph names. No require line other than those three changes. Every workflow that builds this module installs Go from go.mod, so CI and the deploy tooling pick the release up without a workflow edit.
• Advisories: trivy fs --scanners vuln --detection-priority comprehensive on the root module's go.mod/go.sum reports 18 before (13 standard library on 1.26.6, 5 in x/net 0.58.0) and 0 after.
• Build and tests with the exact toolchain (GOTOOLCHAIN=go1.26.9): go build ./... and go vet ./... pass. go test ./... (with LC_ALL=C): 52 packages ok, 2 without tests, 0 failures.
• Out of scope, on purpose: the Helm render profile stays on the audited Go 1.26.3 build. The test-only nested modules mirror upstream dependency graphs. Scanning those is filed as Check the platform's Go modules for known advisories in CI #4961.

[devantler]

🤖 Generated by the Agentic Engineer

[devantler]

@cursor review

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 97842eca-2c10-48d2-9f33-1ac73db64b89)

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: aae32980e13d3a3fab0cd48f47901ae83b2df935

• CodeRabbit: rate limited. Its summary on #4964 (20:57 UTC) states the plan's included review allowance is 1 per hour with 0 remaining.
• Codex: usage limit reached. Codex answered the request on #4964 (20:56 UTC) with its usage-limit reply and a failed review.
• Cursor Bugbot: usage limit reached — requested on this PR at this head, its check-run ended neutral / Error with "Bugbot couldn't run - usage limit reached" (21:15 UTC).

Scope reviewed: go.mod and go.sum only.

• The go directive becomes 1.26.9, the newest 1.26 patch release on go.dev, and every workflow that builds this module reads it through go-version-file: go.mod. The only workflow that pins its own Go builds an upstream hotfix image, not this module.
• golang.org/x/net becomes 0.60.0, and x/sys 0.48.0 and x/text 0.42.0 are its minimums. go.sum swaps exactly those pairs, plus the x/tools 0.49.0 checksum that x/net's module graph names. No other require changes, and nothing is added or removed beyond that.
• A version scan of the module goes from 18 known advisories to 0. The build, vet and the full test suite pass with the exact toolchain, and CI's Go helper suite and every validator pass at this head.
• No behaviour or interface change is intended. Nothing in the diff touches a workflow, a permission, a secret or a manifest.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Readiness at head aae32980e13d3a3fab0cd48f47901ae83b2df935

• Programmatically tested: every check at this head is green, including the Go helper suite, the Talos and manifest validators and the Kubescape gate. There are zero review threads and no conflict with main. The validation comment above has the local evidence (exact-toolchain build, vet and test, and the 18 → 0 advisory scan).
• Reviewed: a clean local review round at this head (review), because no external lane can deliver tonight. CodeRabbit's one included hourly review is used, Codex hit its usage limit, and Bugbot's check-run at this head reported its usage limit. local-review-verdict.sh reads the round as GREEN self@aae32980.
• Tried as a user: the user of this change is the deploy and CI tooling. At this head it built and passed every helper regression with Go 1.26.9 in CI, and locally with the exact toolchain. The merge-group deploy runs the same tooling against production, which is the final exercise.
• Advisory note: Bugbot's neutral check-run is its usage-limit Error, not a finding.

Promoting and queueing at this head.