fix(deps): clear Snyk criticals and highs

[stevenolen]

Summary

Clears the fixable Snyk findings in this module: 21 findings down to 2, including both criticals.

These had not surfaced anywhere because CI runs only snyk container monitor ... --exclude-app-vulns, which by design excludes Go application dependencies. Nothing was scanning this go.mod.

Dependency bumps

Severity	Package	From	To
Critical	golang.org/x/net (idna)	v0.48.0	v0.58.0
Critical	google.golang.org/grpc	v1.77.0	v1.83.2
High	golang.org/x/net/http2 DoS	v0.48.0	v0.58.0
High ×3	grpc/mem, grpc/internal/transport, grpc/internal/envconfig	v1.77.0	v1.83.2
High ×2	github.com/go-jose/go-jose/v4	v4.1.3	v4.1.4
High + Medium	github.com/traefik/traefik/v3	v3.6.4	v3.6.25
High ×6	go.opentelemetry.io/otel/*	v1.39.0 / v0.15.0	v1.44.0 / v0.20.0

The OpenTelemetry packages are all indirect, pulled by traefik, so the traefik bump moves them as a coordinated set rather than needing individual pins.

Go 1.25 to 1.26

traefik v3.6.23 and later require Go 1.26.0, so reaching a patched traefik moves this module off the Go 1.25 line.

The go directive matters for more than the toolchain: Snyk reports the standard library as std/* components versioned from it. Measured against Snyk's database:

go directive	stdlib findings
1.25.3 (before)	16 high, 15 medium, 2 low
1.26.0 (minimum traefik allows)	18 high, 12 medium, 1 low
1.26.8 (this PR)	none

So the directive is set to 1.26.8 rather than the 1.26.0 that go mod tidy would otherwise settle on. Letting it land on 1.26.0 would have left the stdlib posture worse than before this PR.

The go directive has two consumers, and both needed attention:

• CI's Go setup picks it up automatically via go-version-file: go.mod, so no workflow change is needed there.
• The builder image is pinned separately by ARG GO_VERSION in Dockerfile and flightdeck/Dockerfile. The build job and just docker-build both derive that value from go.mod and pass it as a build arg, but make docker-build ran a bare docker build and so fell back to the stale 1.25 default. Since kind-load-image depends on docker-build, the Kind integration tests failed with go.mod requires go >= 1.26.8 (running go 1.25.14; GOTOOLCHAIN=local).

The Makefile now derives GO_VERSION from the go directive and passes it through, matching the Justfile and the build workflow, so the builder image cannot drift from go.mod again. The two ARG defaults move to 1.26 as a fallback for a bare docker build.

Remaining findings

Two, neither with an upstream fix:

1. github.com/jackc/pgproto3/v2 v2.3.3 — Improper Input Validation (high). Reached through github.com/jackc/pgx/v4 v4.18.3, which is a direct dependency imported by internal/db/postgres_client.go and internal/db/pgx_logr.go. v2.3.3 is the latest release of that line; the advisory is resolved only by moving to pgx/v5, which internalises pgproto3. That is an API migration and belongs in its own PR.
2. github.com/grpc-ecosystem/grpc-gateway/v2/runtime — Incorrect Authorization (medium). No patched release; still reproduces on the latest v2.30.0.

Verification

• make go-test exits 0 on Go 1.26.8 (all packages, including internal/controller/core under envtest)
• go build ./... and go vet ./... clean
• snyk test re-run on the branch confirms 2 remaining findings

Note that a bare go test ./... panics in internal/controller/core with a nil client, because localTestEnv.Start needs KUBEBUILDER_ASSETS and the test uses assert rather than require, so it continues past the failed setup. Use make go-test, which provisions envtest. This is unrelated to the dependency changes and reproduces on main.

Also adds the missing CI scan

build.yml now runs snyk monitor --file=go.mod after the unit tests. Both existing Snyk steps scan container images with --exclude-app-vulns, so this module's Go dependencies were never scanned by anything, which is how two criticals went unreported.

Monitor only, matching ptd's snyk.yml: snyk monitor uploads a snapshot and exits 0, so it cannot block the build. No PTD repo currently gates on dependency vulnerabilities; the only Snyk gate in the org is ptd's snyk code test --threshold=medium, which is static analysis.

It runs on main only, deliberately unlike ptd, which also monitors on pull_request. Monitoring from PR branches means the dashboard reports whichever branch was pushed most recently rather than what is shipping. That behaviour actively misled a diagnosis this week, where a project's counts reflected an in-flight branch.

Nothing is required in the Snyk console: snyk monitor creates the project in the org on first run.

Suggested follow-up

Plan the pgx/v4 to pgx/v5 migration to clear the last high.

[claude]

Claude finished @stevenolen's task in 57s —— View job

---

Review

• Gather context
• Read review guidelines
• Review .github/workflows/build.yml changes
• Review go.mod changes
• Post review feedback

---

The PR is solid. The motivation is clear, the scope is appropriate, and the description is thorough enough to stand on its own. A few observations:

.github/workflows/build.yml

The new step is consistent with the existing container scan pattern (no --org flag, which is fine if the token is org-scoped). The if: github.ref == 'refs/heads/main' condition is the right call given the reasoning in the description.

The inline comment block is longer than it needs to be — the decision logic (why monitor-only, why main-only) belongs in the PR description, not the YAML. A single line like # monitor-only: non-blocking, main-only to reflect shipping state would be sufficient for a future reader.

go.mod

The bumps match what the description claims. Two undocumented changes are worth noting:

1. github.com/go-acme/lego jumped a major version: v4.29.0 → v5.3.1 (indirect via traefik). That's expected from the traefik bump but isn't mentioned in the PR table.
2. software.sslmate.com/src/go-pkcs12 v0.7.3 is a net-new indirect dependency, also pulled by the traefik/lego chain. Not a concern, just unmentioned.
3. github.com/aws/aws-sdk-go-v2/internal/ini was dropped silently — AWS SDK v2 internalised that module in later releases, so this is expected, but worth noting.

None of these are blockers. The unmentioned additions are all indirect and come along with the traefik and AWS SDK updates that are explicitly listed.

Overall

The go 1.26.8 choice is well-reasoned (stdlib posture table is a nice addition). The remaining two findings are accurately characterised and the suggested follow-up (pgx/v4 → pgx/v5) is the right call for a separate PR.