[kylos101]

Superseded by #4, which branches from and targets custom-mirror, the head of long-running PR #1.

Description

The published ghcr.io/gitpod-io/buildkit:v0.20.1-gitpod.8 contains Go 1.26.2 / golang.org/x/net 0.55.0 binaries affected by GO-2026-6604 (CVE-2026-56857) and GO-2026-6612 (CVE-2026-78663).

Update the existing Gitpod release branch to Go 1.26.9 and x/net 0.60.0, including the existing CNI/runc dependency pins. Refresh the module graph and vendored dependencies required by that upgrade. Keep the fork's source patches, build stages, flags, and release process.

This targets gitpod/v0.20.1-gitpod.8, the source of the currently consumed image. It deliberately retains that production fork baseline.

Related changes

Required by gitpod-io/gitpod#21636. Bob continues to consume the published Gitpod fork image; the consumer PR needs a one-line image-reference bump after a patched fork release is published. This PR does not publish an image or tag.

How to test

Completed locally on native Linux amd64 with Go 1.26.9:

• GO_VERSION=1.26.9 docker buildx bake binaries --set binaries.platform=linux/amd64 --progress plain passes using this repository's standard binary targets.
• SKIP_INTEGRATION_TESTS=1 go test -timeout 10m ./cmd/buildctl/... ./session/... ./util/resolver/... passes.
• go mod tidy -diff and git diff --check pass.
• Grype 0.121.0, using the October 20, 2026 database, reports zero critical findings when scanning dir:./bin/build. Binary metadata confirms Go 1.26.9 and BuildKit's x/net 0.60.0.
• A baseline scan of the published image confirms both Go advisories before the update.

The zero-critical result applies to the rebuilt binary directory, not a published image or a full production scan. Full integration tests and the release image scan remain required in CI. The CLI integration tests need an external registry and were excluded from the local unit-test run.