Merge branch 'fix/runtime-image-cves-go-1.26.7' into 'master'

chore(deps): bump Go to 1.26.7 and x/mod to v0.40.0 for CVEs

Closes #761

See merge request postgres-ai/database-lab!1183

Author: Sarumyan

.gitlab-ci-security.yml

@@ -26,7 +26,7 @@ cve-govulncheck:
   <<: *security_rules
   stage: security
   image:
-    name: golang:1.26.4
+    name: golang:1.26.7
     pull_policy: if-not-present
   before_script:
     - go install golang.org/x/vuln/cmd/govulncheck@latest

engine/.gitlab-ci.yml

@@ -9,7 +9,7 @@ workflow:
 
 default:
   image:
-    name: golang:1.26.5
+    name: golang:1.26.7
     pull_policy: if-not-present
   interruptible: true  # All jobs can be cancelled by default
 
@@ -71,7 +71,7 @@ lint:
 build-binary-alpine:
   <<: *only_engine
   image:
-    name: golang:1.26.5-alpine
+    name: golang:1.26.7-alpine
     pull_policy: if-not-present
   stage: build-binary
   artifacts:

engine/Dockerfile.dblab-server-debug

@@ -1,7 +1,7 @@
 # How to start a container: https://postgres.ai/docs/how-to-guides/administration/engine-manage
 
 # Compile stage
-FROM golang:1.26.5 AS build-env
+FROM golang:1.26.7 AS build-env
 
 # Build Delve
 RUN go install github.com/go-delve/delve/cmd/dlv@latest

engine/Dockerfile.rds-refresh

@@ -1,6 +1,7 @@
-FROM alpine:3.23
+FROM alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
 
-RUN apk add --no-cache ca-certificates tzdata
+RUN apk upgrade --no-cache \
+  && apk add --no-cache ca-certificates tzdata
 
 # create non-root user
 RUN adduser -D -u 1000 appuser

engine/go.mod

@@ -36,7 +36,7 @@ require (
 	github.com/urfave/cli/v2 v2.25.7
 	github.com/wagslane/go-password-validator v0.3.0
 	golang.org/x/crypto v0.52.0
-	golang.org/x/mod v0.37.0
+	golang.org/x/mod v0.40.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/term v0.43.0
 	gopkg.in/yaml.v2 v2.4.0

engine/go.sum

@@ -253,8 +253,8 @@ go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
 golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
 golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=