fix: bump extras/dagger Go toolchain for GO-2026-6617-stdlib

[chainloop-platform]

Summary

Bump the Dagger helper module's Go toolchain directive from 1.26.1 to 1.26.9 so its stdlib metadata no longer points at a vulnerable release line. The production root module was already on Go 1.27.2, so this is the smallest change needed to remove the stale vulnerable toolchain declaration.

Vulnerability Fixed

GO-2026-6617-stdlib (HIGH): HTTP/2 servers can crash if concurrent HPACK encoder updates race while handling SETTINGS_HEADER_TABLE_SIZE changes from a client.

Changes Made

• Updated extras/dagger/go.mod from go 1.26.1 to go 1.26.9, the first fixed release identified for the Go 1.26 line.
• Left the root module unchanged because go.mod already pins Go 1.27.2, which the assessment identified as fixed.
• Kept the remediation scoped to the Dagger helper module because its stale Go directive was the only remaining vulnerable toolchain declaration in the repository.

Verification

Ran syft dir:. -o cyclonedx-json=- | grype sbom:- --only-fixed -o json from the repository root against the patched source tree. Outcome: resolved for GO-2026-6617-stdlib, which is no longer reported in the SBOM scan after the extras/dagger/go.mod toolchain bump.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⏭️ bypassed by label

AI Coding Session Check Bypassed

This PR carries the skip-ai-session label, so the AI coding session check was bypassed.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace