CP-47356: Build on Go 1.26.7 to clear stdlib CVEs

.github/workflows/docker-build.yml

@@ -302,6 +302,10 @@ jobs:
           image: ${{ env.REGISTRY_PROD_ADDR }}/${{ env.UNTESTED_IMAGE_NAME }}:${{ steps.meta.outputs.version }}
           fail-build: true
           severity-cutoff: high
+          # Print findings to the log. The action otherwise defaults to
+          # SARIF written to a temp file nothing here reads, so a failure
+          # says findings exist without saying what they are.
+          output-format: table
 
   k8s-version-matrix-tests:
     # These should match the permissions in the called workflow.

.github/workflows/scan-images.yml

@@ -47,3 +47,7 @@ jobs:
           image: ${{ env.REGISTRY }}:${{ matrix.tag }}
           fail-build: true
           severity-cutoff: high
+          # Print findings to the log. The action otherwise defaults to
+          # SARIF written to a temp file nothing here reads, so a failure
+          # says findings exist without saying what they are.
+          output-format: table

.tools/go.mod

@@ -1,6 +1,6 @@
 module github.com/cloudzero/cloudzero-agent/.tools
 
-go 1.26.5
+go 1.26.7
 
 require (
 	github.com/homeport/dyff v1.12.0

docker/Dockerfile

@@ -2,7 +2,7 @@ ARG DEPLOY_IMAGE=scratch
 
 # prometheus-config-reloader version, built from source in the "reloader" stage.
 # Git tag — Dependabot can't track it, so bump by hand (see DEVELOPMENT.md).
-ARG RELOADER_VERSION=v0.91.0
+ARG RELOADER_VERSION=v0.93.1
 
 # Multi-stage Docker build with platform-specific cache optimization:
 # 1. base-tools: Install system packages and tools (cached per platform)
@@ -14,7 +14,7 @@ ARG RELOADER_VERSION=v0.91.0
 # 7. final: Minimal runtime image with compiled binaries
 
 # Stage 1: Base tools installation
-FROM --platform=$BUILDPLATFORM golang:1.26.5-alpine AS base-tools
+FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine AS base-tools
 ARG TARGETPLATFORM
 ARG TARGETOS TARGETARCH
 
@@ -90,9 +90,12 @@ WORKDIR /reloader-src
 RUN git clone --depth 1 --branch "${RELOADER_VERSION}" \
         https://github.com/prometheus-operator/prometheus-operator.git .
 
-# Bump vulnerable deps ahead of upstream's pins so the scan passes; drop when upstream catches up.
+# Upstream still ships x/crypto v0.54.0, which has GO-2026-6303, GO-2026-6354
+# and GO-2026-6355 open against it. This is an exact version and so downgrades
+# as readily as it upgrades: check what upstream resolves before touching it,
+# and delete it once upstream passes it rather than bumping it forever.
 RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \
-    go get golang.org/x/crypto@v0.53.0 golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0
+    go get golang.org/x/crypto@v0.56.0
 
 RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \
     --mount=type=cache,target=/root/.cache/go-build,id=gobuild-reloader-$TARGETPLATFORM \

go.mod

@@ -1,6 +1,6 @@
 module github.com/cloudzero/cloudzero-agent
 
-go 1.26.5
+go 1.26.7
 
 require (
 	github.com/google/go-cmp v0.7.0

tests/docker/Dockerfile.smoke-tests

@@ -8,7 +8,7 @@
 # components, avoiding the need to build and coordinate multiple images.
 
 # Stage 1: Base tools installation
-FROM golang:1.26.5-alpine AS base-tools
+FROM golang:1.26.7-alpine AS base-tools
 WORKDIR /app
 
 # Install system packages needed for building

tests/go.mod

@@ -1,6 +1,6 @@
 module github.com/cloudzero/cloudzero-agent/tests
 
-go 1.26.5
+go 1.26.7
 
 require (
 	github.com/andybalholm/brotli v1.2.2

tests/integration/test_server/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.5
+FROM golang:1.26.7
 
 WORKDIR /app
 

tests/integration/test_server/go.mod

@@ -1,5 +1,5 @@
 module main
 
-go 1.26.5
+go 1.26.7
 
 require github.com/golang/snappy v1.0.0