[Snyk] Security upgrade golang from latest to 1.26rc2

[itsouvalas]

Snyk has created this PR to fix 5 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• vendor/github.com/nxadm/tail/Dockerfile

We recommend upgrading to golang:1.26rc2, as this image has only 121 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	CVE-2025-15468 SNYK-DEBIAN13-OPENSSL-15123158
	CVE-2025-15469 SNYK-DEBIAN13-OPENSSL-15123166
	CVE-2025-15467 SNYK-DEBIAN13-OPENSSL-15123178
	CVE-2025-66199 SNYK-DEBIAN13-OPENSSL-15123183
	CVE-2025-68160 SNYK-DEBIAN13-OPENSSL-15123204

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[wayneeseguin]

Closing — this change cannot survive in the tree, and the toolchain it targets is not the one SHIELD builds with.

The only file it touches is vendor/github.com/nxadm/tail/Dockerfile, a vendored copy of a third-party test fixture. SHIELD never builds it — the only Dockerfile in the build path is the repo-root Dockerfile, which is already pinned to golang:1.25-bookworm.

Worse, the edit is transient. I applied it locally and then ran go mod vendor: the file reverts to FROM golang and git status reports the vendor tree clean again. Any routine dependency refresh silently erases it, so the alert would reappear with no trace of why.

It also pins a release candidate. golang:1.26rc2 is pre-release; develop currently declares go 1.25.12 and builds on the 1.25 line. Moving the build to an RC is not a security upgrade.

If the intent was to raise the Go toolchain floor, the change belongs in the repo-root Dockerfile and the go directive in go.mod — see #813, which moved that floor to 1.25.12 and cleared the outstanding stdlib advisories (GO-2026-4342, GO-2026-4977, GO-2026-4986).