[kylos101]

Description

Update production Go dependencies and bundled executables to remove critical standard-library and HTTP/2 vulnerabilities, and fix critical vulnerabilities in standalone CI tooling.

golang.org/x/net 0.60.0 requires Go 1.26 and the accompanying x/* updates across the repository's modules.

Dependency / artifact	Change	Critical advisories
Go modules	Upgrade golang.org/x/net 0.55.0 → 0.60.0 and its required supporting x/* dependencies; raise module Go requirements to 1.26	CVE-2026-78663 / GO-2026-6612
Bundled Caddy, ws-daemon runc/Git LFS, docker-up runc, Docker Compose	Rebuild with Go 1.26.9 and patched x/net	CVE-2026-56857 / GO-2026-6604; CVE-2026-78663 / GO-2026-6612
Bundled Docker CLI and workspace fallback Engine	29.5.3 → 29.9.0, built with Go 1.26.9	Same Go advisories
Standalone dev/npm-tools	npm 11.7.0 → 11.21.1; node-gyp 10.3.1 → 11.5.0; resolve tar 7.5.22, Handlebars 4.7.10, proxy-addr 2.0.8	CVE-2026-59873; CVE-2026-33937, CVE-2026-106445, CVE-2026-106446; CVE-2026-90711
IDE update automation	Refresh Axios within 1.x, resolving form-data 4.0.0 → 4.0.6	CVE-2025-7783
Bob's BuildKit base image	ghcr.io/gitpod-io/buildkit:v0.20.1-gitpod.8 → ghcr.io/gitpod-io/buildkit:v0.34.0-gitpod.1, pinned by digest	Previous Critical Go runtime and HTTP/2 findings absent from the rebuilt Bob image; CI for the GHCR switch is pending

Correct workspacekit's sync-message format string so Go vet accepts the updated module.

The standalone npm lockfiles are actively consumed by IDE workflows and development-image tooling; the root workspace's merged npm fixes do not update them.

Existing TypeORM and containerd CRI exceptions in WORKSPACE.yaml remain unchanged, with no new suppressions. A broad source scan also reports stale tar, Handlebars, and protobufjs entries in components/ide-metrics-api/typescript-grpc/yarn.lock; its Leeway target explicitly uses the patched root lockfile instead, so this unused lockfile is unchanged.

Bob now consumes the fork workflow's published image ghcr.io/gitpod-io/buildkit:v0.34.0-gitpod.1@sha256:dbe25ae89df951659bbb996465754eba57281de9a99bdf1e27216c89098eee55. The image's embedded revision is 58f91399d4b52985b952870fc08b3a3bd4bc0ca3 on custom-mirror; the image publication and draft release jobs succeeded. Tests run independently of release creation. The consumer uses GHCR directly and preserves the existing Bob packaging and runc facade. A full local scan of the rebuilt Bob image has zero Critical findings, with the previous GO-2026-6604 / CVE-2026-56857 and GO-2026-6612 / CVE-2026-78663 findings absent.

After this lands, the patched npm tools need the normal development-image publication and consumer-promotion follow-up.

Related Issue(s)

Follow-up to #21639 and #21640. Includes the consumer update for the reviewed and published Gitpod BuildKit fork image.

How to test

Current GHCR consumer update (c80f444f6): local build and scan passed; a new Gitpod CI scan and workspace preview validation are pending. The earlier CI results below used the Core Dev image and do not validate this new GHCR digest.

Previous CI validation, before the GHCR switch, for a35ad0257e6ceadbc94c5b7f60ee574b2e8cb749: Branch Build run 39491270707 and its Build Gitpod job completed successfully. The vulnerability reports artifact contains vulnerability-stats.json: all 116 scanned packages have zero Critical findings, including components/image-builder-bob:docker. Bob's Docker image has 11 High, 14 Medium, 3 Low and 4 Unknown findings in this CI scan; this PR does not remove all CVEs. The scheduled-only Critical gate was skipped in this regular PR run; the zero-Critical assertion above was checked directly against the uploaded scan results. Workspace integration jobs were skipped in that run, so the earlier integration results below remain the available evidence for those suites.

Local GHCR image validation: rebuilt the Bob Dockerfile with the pinned published base and the same Bob/runc-facade binaries previously compiled from this PR using Go 1.26.9; no Go source changed. bob --help and packaged buildkitd --version pass. Full Grype 0.121.0 scan, without --only-fixed or suppressions: 0 Critical, 11 High, 12 Medium, 2 Low package matches. The Critical threshold and explicit assertions that the previous Critical advisory IDs are absent both pass. Remaining High findings are three gRPC advisories in Bob and its facade (six matches) and five containerd advisories in Bob (five matches). Lower-severity findings remain in containerd, Bob's BuildKit client, OpenTelemetry, Docker distribution, BusyBox and nghttp2. Pre-commit passed. This local Docker build reused the direct Go compilation fallback because the environment's golangci-lint binary was built with Go 1.25.

Before the Bob image update, 34fe89287294493292de8cbf627a1c0aad811a2d passed the workspace integration job: 32 passed, 0 failed, 13 skipped across the selected suites. The workspace package itself had 7 passed, 0 failed, 9 skipped. Docker-in-workspace, base-image build, and parallel-image-build tests passed. Skips were for username-dependent tests, disabled GitLab integration, maintenance labels, and unsupported k3s; none were caused by CVEs. See JUnit results. These results predate the BuildKit base-image update.

Completed locally with Go 1.26.9 and a fresh Grype 0.121.0 database built October 20, 2026:

• go mod tidy -diff passes in all 60 changed Go modules; go build ./... passes in 20 production modules.
• go test ./... passes in ws-proxy, image-builder-bob, and workspacekit. All common-go packages except baseserver pass; that test and a local Leeway build are blocked by this environment already occupying hard-coded port 127.0.0.1:8765.
• Rebuilt standard and plugin-enabled Caddy, ws-daemon runc/Git LFS, docker-up runc, Docker Compose, and Docker CLI binaries scan with zero CRITICAL findings.
• Both updated standalone npm lockfiles scan with zero CRITICAL findings. Clean npm ci and frozen Yarn installs pass; node-gyp builds and loads a native addon, and xunit-viewer renders a report.
• leeway vet --ignore-warnings, pre-commit for all changed files, and git diff --check pass.

To repeat production scanning, dispatch branch-build.yml on fix/critical-go-cves with simulate_scheduled_run=true and inspect vulnerability-stats.json. Require zero Critical findings in every package, including Bob; the new GHCR-based Bob image meets that threshold locally, and CI confirmation of this digest is pending. Select with-integration-tests=workspace for the preview integration suite.

Documentation

No public documentation updates are required.

Preview status

Gitpod was successfully deployed to your preview environment.

• 🏷️ Name - fix-critical-go-cves
• 🔗 URL - fix-critical-go-cves.preview.gitpod-dev.com/workspaces.
• 📚 Documentation - See our internal documentation for information on how to interact with your preview environment.
• 📦 Version - fix-critical-go-cves-gha.412
• 🗒️ Logs - GCP Logs Explorer

Build Options

Build

• /werft with-werft
  Run the build with werft instead of GHA
• leeway-no-cache
• /werft no-test
  Run Leeway with --dont-test

Publish

• /werft publish-to-npm
• /werft publish-to-jb-marketplace

Installer

• analytics=segment
• with-dedicated-emulation
• workspace-feature-flags
  Add desired feature flags to the end of the line above, space separated

Preview Environment / Integration Tests

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-large-vm
• /werft with-gce-vm
  If enabled this will create the environment on GCE infra
• /werft preemptible
  Saves cost. Untick this only if you're really sure you need a non-preemtible machine.
• with-integration-tests=workspace
  Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh. If enabled, with-preview and with-large-vm will be enabled.
• with-monitoring

/hold

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​npm@​11.7.0 ⏵ 11.21.1	-1		-2
	golang/​golang.org/​x/​crypto@​v0.57.0
	golang/​golang.org/​x/​net@​v0.55.0 ⏵ v0.60.0
	golang/​golang.org/​x/​sys@​v0.46.0 ⏵ v0.48.0	+1
	npm/​axios@​1.7.2 ⏵ 1.20.0	-1	+75		-3
	npm/​node-gyp@​10.3.1 ⏵ 11.5.0			+1
	golang/​golang.org/​x/​sync@​v0.20.0 ⏵ v0.23.0	+1
	golang/​golang.org/​x/​term@​v0.43.0 ⏵ v0.46.0	+1

View full report

[kylos101]

Updating devcontainer image in #21640 to use new version of go and lint.