fix(build): upgrade service builders to Go 1.26.6

[plural-copilot]

Summary

• upgrades the production Go builders and workflow-selected Go declarations for nexus, deployment-controller, kubernetes-agent, and oci-auth from Go 1.26.5 to Go 1.26.6
• confirms release build wiring selects the updated Dockerfiles/version files and does not pass a Go-version override
• intentionally excludes console CLI/plural-cli, git-server, redis, cloud-query-db, GitOps image tags, and golang.org/x/crypto/openpgp

Affected images

• nexus:0.12.38
• deployment-controller:v0.12.38
• kubernetes-agent:v0.12.38
• oci-auth:v0.12.39

Remediated CVEs

CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862.

Validation

• Go 1.26.6 image availability and affected Go module/workspace metadata parsing
• full local Docker builds for nexus, deployment-controller, and oci-auth
• Dockerfile/workflow declaration, build-arg, diff, and scope checks
• kubernetes-agent production Docker build started with Go 1.26.6 and reached API compilation before local run time expired; CI will perform the authoritative multi-platform build.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create one focused remediation PR for Go stdlib vulnerabilities in the deployed mgmt/console service images: nexus:0.12.38, deployment-controller:v0.12.38, kubernetes-agent:0.12.38, and oci-auth:v0.12.39. Scanner says all were built with Go 1.26.5; fixed target is Go >=1.26.6. CVEs: CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862....
🔗 Run history	View run history

[soffi-ai]

Soffi AI Summary

This PR upgrades the Go toolchain version from 1.26.5 to 1.26.6 across all affected service builders and Go module declarations in the monorepo. The motivation is security: Go 1.26.6 remediates eight CVEs (CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862). The upgrade touches Dockerfiles and go.mod files for nexus, deployment-controller (go/controller), kubernetes-agent, and oci-auth, as well as the workspace-level go.work file. Intentionally excluded are the console CLI, git-server, redis, cloud-query-db, GitOps image tags, and the golang.org/x/crypto/openpgp dependency.

Changes

Go 1.26.6 security upgrade

• Bumps Go toolchain from 1.26.5 to 1.26.6 in Dockerfiles (go/controller, go/nexus, go/oci-auth, go/kubernetes-agent) and all corresponding go.mod / go.work declarations to remediate eight CVEs in the Go standard library. No Go-version build-arg overrides were added; the version change flows naturally through the workspace and image builds. (f2c31aa)

---

Updated: 2026-08-26 19:43 UTC

Deploy in Soffi

[greptile-apps]

Greptile Summary

The PR consistently upgrades the production Go builder images and corresponding module/workspace declarations from Go 1.26.5 to Go 1.26.6.

• Updates the controller, Kubernetes agent, nexus, and OCI authentication builder images.
• Aligns the associated go.mod files and workspace declaration with the new patch release.
• Leaves application dependencies and checksums unchanged.

Confidence Score: 5/5

The PR appears safe to merge because the builder and module declarations are consistently upgraded without changing application dependencies or runtime behavior.

The changes are limited to matching Go patch-version declarations in production builders, service modules, and the workspace, with no concrete changed-code-triggered failure identified.

Important Files Changed

Filename	Overview
go/controller/Dockerfile	Updates the controller production builder image to Go 1.26.6 consistently with its module declaration.
go/controller/go.mod	Raises only the controller Go directive; dependency versions remain unchanged.
go/go.work	Aligns the workspace Go declaration with the upgraded service modules.
go/kubernetes-agent/api/go.mod	Raises only the Kubernetes agent API module’s Go directive.
go/kubernetes-agent/hack/docker/Dockerfile	Updates the shared multi-binary Kubernetes agent builder to Go 1.26.6-alpine.
go/kubernetes-agent/kas/go.mod	Raises only the KAS module’s Go directive without changing dependencies.
go/nexus/Dockerfile	Updates the nexus Alpine builder image to Go 1.26.6.
go/nexus/go.mod	Aligns the nexus module directive with its upgraded builder.
go/oci-auth/Dockerfile	Updates the OCI authentication service builder image to Go 1.26.6.
go/oci-auth/go.mod	Aligns the OCI authentication module directive with its upgraded builder.

_{Reviews (1): Last reviewed commit: "fix(build): upgrade service builders to ..." | Re-trigger Greptile}