[kylos101]

Description

Patch the Go runtime, HTTP/2, and gRPC dependencies directly on the Gitpod fork's custom-mirror branch, the head of long-running PR #1.

Branch ancestry

• Base: custom-mirror at 93509e16a383c7e9baf619c704ae632b864196f1.
• Head: fix/custom-mirror-http2 at 92b5c43d289c9fd3d2db8e3291b15381c6ebbccb.
• The head is one commit whose sole parent is that exact custom-mirror commit.

Changes

• Go 1.26.9 in the build/test workflows and both build Dockerfiles, with Alpine 3.23 because the Go 1.26.9 Alpine 3.22 image does not exist.
• golang.org/x/net 0.60.0 and required supporting x/* updates for GO-2026-6604 / GO-2026-6612.
• gRPC 1.69.4 → 1.79.3 for critical GHSA-p77j-4mvh-x3m3, which the fresh custom-mirror build still reported after the Go/HTTP2 update. Refresh its required dependency graph.
• Build the existing CNI 1.5.1 sources with the patched Go toolchain instead of downloading precompiled binaries. Existing CNI and runc version pins remain unchanged.
• Regenerate vendored dependencies. All files outside vendor are the two workflows, two build Dockerfiles, go.mod, and go.sum.

Related changes and publication

Supersedes closed #4. Supports gitpod-io/gitpod#21636.

The maintainer will review and publish the image manually to Gitpod Core Dev after merging into custom-mirror. Long-running PR #1 remains open against master. No merge, tag, or image publication has been performed.

This deliberately does not import the release branch wholesale. Its separate Git source validation backport and VEX changes are not included; review those separately before replacing an existing release that already contains that backport.

How to test

Completed on native Linux amd64 using Go 1.26.9:

• GO_VERSION=1.26.9 docker buildx bake binaries --set binaries.platform=linux/amd64 --progress plain passes.
• SKIP_INTEGRATION_TESTS=1 go test -timeout 10m ./cmd/buildctl/... ./session/... ./util/resolver/... ./source/git/... ./util/gitutil/... passes.
• go mod tidy -diff passes.
• Grype 0.121.0 with the October 20, 2026 database finds 0 critical, 28 high, 29 medium, and 12 low matches in the rebuilt binary directory. This is a binary scan, not proof that all source-level vulnerabilities are absent or validation of a published image.
• git diff --check -- . ':!vendor' passes. The full check reports upstream whitespace in vendored OpenTelemetry CONTRIBUTING.md; generated vendor contents are preserved.

Full integration tests and a scan of the manually published image remain outstanding. Local tests exclude integration tests requiring an external registry.