fix(deployment-operator): remediate image vulnerabilities

[plural-copilot]

Scope

Remediates vulnerabilities for the deployment-operator image only. Changes are limited to its Docker builder input, Go module metadata, and the Go workspace version needed for its CI/test commands. No GitOps manifests, image tags/references, Helm CLI version, or other service images were changed.

Vulnerability remediation

Component	Final version	Remediation
Go stdlib/toolchain	1.26.6	Docker builder updated to golang:1.26.6-alpine3.23; go.mod and go.work directives updated to 1.26.6.
oras.land/oras-go/v2	2.6.2	Existing resolved production version satisfies target.
google.golang.org/grpc	1.82.1	Existing resolved production version satisfies target.
golang.org/x/text	0.41.0	Existing resolved production version satisfies target.
golang.org/x/net	0.58.0	Existing resolved production version satisfies target.
github.com/vmware-tanzu/velero	1.18.1	Direct app dependency upgraded from 1.16.2.
github.com/containerd/containerd	1.7.33	Existing module replace and resolved production version satisfy target.
github.com/aquasecurity/trivy	0.72.0	Direct app dependency upgraded from 0.71.0.

go get used exact Trivy and Velero target versions, followed by go mod tidy; related go.mod/go.sum transitive refreshes are Go MVS consequences of those direct upgrades rather than a broad dependency update.

Test Plan

Test Environment: https://console.plrldemo.onplural.sh/cd/clusters/a1748282-ce8b-48ab-ae7e-326e74fce04e/services/f3f89a54-d1a7-4bc8-9152-daa07ede918d/components

Presence decisions

• The final Docker stage contains the static deployment-agent plus the Dockerfile-downloaded Helm CLI only.
• go list -deps ./cmd/agent and go version -m on the built final binary confirm all listed Go components are in the production agent closure at the versions above; there are no intentionally excluded scanner findings.
• Helm remains v3.21.2+g1259634: it is a separately downloaded Dockerfile binary, independent of helm.sh/helm/v3, and is not implicated by these findings.

Validation

• ✅ docker build --file go/deployment-operator/Dockerfile --tag deployment-operator-vuln-remediation:local ./go completed successfully (production-equivalent Docker build; initial uncached run timed out at 15 minutes during compilation, cached retry passed).
• ✅ Inspected final runtime image: entrypoint /workspace/deployment-agent, user 65532:65532, Helm v3.21.2+g1259634.
• ✅ go version -m on the final agent reported Go 1.26.6 and all remediated component versions.
• ✅ go mod tidy -diff (Go 1.26.6, GOWORK=off) and git diff --check.
• ✅ go test -run "^$" -tags=cache ./cmd/agent ./internal/controller ./pkg/controller/restore ./pkg/harness/security/trivy passed in a Go 1.26.6 container with CGO enabled.
• ⚠️ Documented make test was attempted twice. The first attempt identified the workspace Go directive mismatch fixed here. The retry was blocked before test execution by container VCS stamping (error obtaining VCS status: exit status 128) and gotestsum reporting no Go files. CI/full envtest should re-run where normal Git metadata is available.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create exactly one PR that remediates vulnerabilities for only the deployment-operator image ghcr.io/pluralsh/deployment-operator:sha-36ca088....
🔗 Run history	View run history

[soffi-ai]

Soffi AI Summary

This PR remediates image vulnerabilities in the deployment-operator and upgrades the Go toolchain across all service images in the monorepo. The core motivation is security: several Go dependencies in the deployment-operator had known CVEs, and the Go builder image itself was outdated. Direct dependencies github.com/aquasecurity/trivy (0.71.0 → 0.72.0) and github.com/vmware-tanzu/velero (1.16.2 → 1.18.1) were explicitly upgraded; transitive dependencies were refreshed via go mod tidy as a consequence of MVS resolution. Separately, all Dockerfiles across every Go service in the monorepo were updated to use golang:1.26.6-alpine3.23 as the builder base, and the go.mod/go.work toolchain directives were aligned to Go 1.26.6 to ensure consistent build environments and eliminate toolchain-version mismatches that were blocking CI.

Changes

Deployment-operator vulnerability remediation

• Upgraded direct Go dependencies in the deployment-operator module to address CVEs: aquasecurity/trivy bumped from 0.71.0 to 0.72.0 and vmware-tanzu/velero from 1.16.2 to 1.18.1. Ran go mod tidy to refresh transitive dependencies (e.g. trivy-db, cel.dev/expr, AWS SDK submodules, fsnotify, docker-credential-helpers) as an MVS consequence of those direct upgrades. (02420d7)
• Updated the go.mod and go.work toolchain directives to Go 1.26.6 and updated the deployment-operator's Dockerfile builder stage to golang:1.26.6-alpine3.23. This resolves a workspace Go directive mismatch that was blocking make test from running in CI and ensures the production agent binary is stamped with the remediated toolchain version. (9f76a17)

Go 1.26.6 builder upgrade across all services

• Updated the FROM golang:... builder line in every Dockerfile across the monorepo (controller, deployment-operator, kubernetes-agent, ai-proxy, nexus, cloud-query, observability-proxy, datastore, oci-auth, and shared build/test images) to golang:1.26.6-alpine3.23, ensuring a consistent and vulnerability-free Go build environment for all services. (9140532)

---

Updated: 2026-08-28 01:55 UTC

Deploy in Soffi

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​aquasecurity/​trivy@​v0.71.0 ⏵ v0.72.0	+1	+18
	golang/​github.com/​onsi/​gomega@​v1.40.0
	golang/​github.com/​vmware-tanzu/​velero@​v1.16.2 ⏵ v1.18.1	+1	+2
	golang/​github.com/​aquasecurity/​trivy-db@​v0.0.0-20251222105351-a833f47f8f0d ⏵ v0.0.0-20260629102122-a0049d7ad12f
	golang/​github.com/​onsi/​ginkgo/​v2@​v2.28.3
	golang/​github.com/​vektah/​gqlparser/​v2@​v2.5.33

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang github.com/aquasecurity/trivy-db is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go/deployment-operator/go.mod → golang/github.com/aquasecurity/trivy-db@v0.0.0-20260629102122-a0049d7ad12f ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/aquasecurity/trivy-db@v0.0.0-20260629102122-a0049d7ad12f. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[greptile-apps]

Greptile Summary

The PR updates the deployment-operator’s builder and workspace to Go 1.26.6 and refreshes its module graph to remediate image vulnerabilities.

• Upgrades the Docker builder and Go directives to 1.26.6.
• Upgrades Trivy to 0.72.0 and Velero to 1.18.1.
• Records the resulting direct and transitive module checksum changes.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified.

The builder, module, and workspace versions remain aligned, and the dependency refresh did not establish a reachable regression or newly introduced vulnerable execution path.

Important Files Changed

Filename	Overview
go/deployment-operator/Dockerfile	Updates the build-stage Go image from 1.26.5 to 1.26.6 without changing the runtime image or build flow.
go/deployment-operator/go.mod	Aligns the Go directive and upgrades Trivy, Velero, and their resolved transitive dependencies; no actionable compatibility or reachability defect was found.
go/deployment-operator/go.sum	Refreshes checksums consistently with the module graph changes.
go/go.work	Aligns the workspace Go directive with the deployment-operator module and builder toolchain.

_{Reviews (1): Last reviewed commit: "fix(deployment-operator): remediate imag..." | Re-trigger Greptile}

[michaeljguarino]

you SHOULD update all images to go 1.26.6, not revert dumbass