[abtreece]

Why

The Docker workflow's security-scan (Trivy, HIGH,CRITICAL, ignore-unfixed) fails on the open Dependabot PRs. The findings come from main, not from the PRs. A rerun of the scan on #641 reports 6 HIGH in the Go binary:

• stdlib 1.26.8 (4): CVE-2026-111943, CVE-2026-78667, CVE-2026-78669, CVE-2026-97031
• golang.org/x/net 0.59.0 (1): CVE-2026-78669
• github.com/go-jose/go-jose/v4 4.1.4 (1): CVE-2026-116587

The scans from the original Dependabot runs also flagged libcrypto3/libssl3 in the alpine:3.21 base. That is resolved upstream: the rerun pulled alpine 3.21.9, which has 0 findings.

What

• Go toolchain 1.26.8 → 1.26.10 everywhere it's pinned (same file set as chore: bump Go to 1.26.8 and x/net, x/text, x/crypto, grpc for CVEs #636: workflows, .tool-versions, docker/Dockerfile.build, go.mod toolchain, docs)
• github.com/go-jose/go-jose/v4 4.1.4 → 4.1.6 (indirect, via vault/api)
• golang.org/x/net 0.59.0 → 0.60.0
• vendor/ refreshed; CHANGELOG [Unreleased] entry added

Verification

• go test -mod=vendor -race ./...: pass
• docker build -f docker/Dockerfile.build, then Trivy (aquasec/trivy:latest) with the CI flags: 0 HIGH/CRITICAL on both the alpine layer and the Go binary
• Control: a binary built from the chore(deps): bump go.etcd.io/etcd/api/v3 from 3.6.11 to 3.7.2 #642 branch (still Go 1.26.8, go-jose 4.1.4, x/net 0.59.0) scans at the same 6 HIGH as CI
• docker run confd:scan --version reports go1.26.10

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.90%. Comparing base (e030958) to head (e8dd0b0).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #643      +/-   ##
==========================================
- Coverage   70.96%   70.90%   -0.06%     
==========================================
  Files          53       53              
  Lines        5682     5682              
==========================================
- Hits         4032     4029       -3     
- Misses       1422     1425       +3     
  Partials      228      228              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟢 Approval recommended

No active review issues are blocking the toolchain and dependency security updates.

No open issues 🎉

_{Review effort: Balanced}