fix(deps): remediate plural CLI Go vulnerabilities

[plural-copilot]

Summary

Remediates Go vulnerabilities in the bundled plural CLI associated with deployed ghcr.io/pluralsh/console:sha-ce1294d. The Console image’s bundled CLI maps to this plural-cli repository.

Advisory → fix mapping

• GO-2026-6179, GO-2026-6180: golang.org/x/mod v0.37.0 → v0.40.0
• CVE-2026-71556, CVE-2026-71557: github.com/go-git/go-git/v5 v5.19.1 → v5.19.2

go mod tidy retained the compatible resolved module-graph updates required by these selections: golang.org/x/crypto, x/net, x/sys, x/term, x/text, and x/tools.

Toolchain/build-pin finding

The distributed CLI is built from ./cmd/plural by:

• Dockerfile, which CI uses to publish ghcr.io/pluralsh/plural-cli; and
• GoReleaser/Makefile targets, with GitHub Actions and GoReleaser selecting Go from go.mod.

The participating pins were changed from Go 1.26.5 to 1.26.6:

• Dockerfile: builder and final stages now use golang:1.26.6-alpine3.24.
• go.mod: go 1.26.6.

Inspected but intentionally unchanged: test.Dockerfile is only docker-compose test wiring, and hack/gen-client-mocks.sh / hack/lib.sh only drive mock generation; none produce the distributed CLI artifact.

Files changed

• Dockerfile — update artifact builder/final Go image pin.
• go.mod — update Go directive and fixed module versions.
• go.sum — tidy checksums and resolved required transitive module versions.

Validation

Using golang:1.26.6-alpine3.24:

• go mod tidy
• go test ./pkg/utils/git/... ✅ (package has no test files)
• go build -o /tmp/plural ./cmd/plural ✅
• /tmp/plural version ✅
• git diff --check ✅

The Docker daemon was available, but an exact docker build was blocked by the agent harness command policy; the direct Go build above validates the CLI compilation with the same 1.26.6 builder toolchain.

Follow-up

This PR intentionally makes no GitOps or image-tag changes. After merge, image publishing and any GitOps image-tag updates must follow separately.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create one focused remediation PR in this repository for Go vulnerabilities in the bundled plural CLI found in deployed ghcr.io/pluralsh/console:sha-ce1294d....
🔗 Run history	View run history

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​crypto@​v0.53.0 ⏵ v0.55.0
	golang.org/​x/​text@​v0.39.0 ⏵ v0.41.0	+1
	github.com/​go-git/​go-git/​v5@​v5.19.1 ⏵ v5.19.2	+1	+18
	golang.org/​x/​term@​v0.44.0 ⏵ v0.45.0

View full report

[greptile-apps]

Greptile Summary

The PR updates the Go toolchain and selected Go dependencies to remediate reported vulnerabilities.

• Pins Go 1.26.6 in the module directive and both Docker image stages.
• Updates go-git, x/mod, and compatible transitive x/* module versions.
• Regenerates module checksums for the updated dependency graph.

Confidence Score: 5/5

The PR appears safe to merge because no actionable changed-code failure was identified.

The toolchain and dependency pins are updated consistently across the Dockerfile and Go module metadata, while the additional advisory matches concern unchanged, unreachable transitive code.

Important Files Changed

Filename	Overview
Dockerfile	Updates both builder and runtime Go image pins consistently from 1.26.5 to 1.26.6.
go.mod	Updates the Go directive and targeted dependency versions with compatible transitive module selections; no actionable regression was identified.
go.sum	Replaces checksums consistently for the module versions selected in go.mod.

_{Reviews (1): Last reviewed commit: "fix(deps): remediate plural CLI Go vulne..." | Re-trigger Greptile}