[plural-copilot]

Summary

Remediates build inputs for the deployed mgmt/console artifact paths without changing GitOps manifests or deployed image tags.

Vulnerability / fix mapping

• Go standard library findings: raised the workspace, in-scope module directives, and production builder images to Go 1.27.3.
• golang.org/x/net: kubernetes-agent api and kas now resolve v0.60.0; the deployment-controller build graph was also aligned to v0.60.0 with its required x/* companion updates.
• github.com/klauspost/compress: kubernetes-agent api/kas and deployment-controller each resolve v1.18.7.
• kubernetes-agent final-image ca-certificates / tzdata: pinned the final distroless Debian 12 base to current multi-architecture digest sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab, refreshing scanner-visible OS artifacts on rebuild.

Affected artifacts

• ghcr.io/pluralsh/kubernetes-agent:0.12.51 — kas and api binaries built by go/kubernetes-agent/hack/docker/Dockerfile
• ghcr.io/pluralsh/deployment-controller:v0.12.51 — built by go/controller/Dockerfile

Validation

Passed:

# In Go 1.27.3 containers, for each module:
go mod download
go list -m all | grep -E '^(golang.org/x/net|github.com/klauspost/compress) '
# go/kubernetes-agent/api, go/kubernetes-agent/kas, go/controller
# Result: x/net v0.60.0; klauspost/compress v1.18.7

git diff --check

Attempted but not completed in this harness:

• focused Go tests
• production Docker builds for both artifact paths

The installed Docker environment does not provide buildx, and legacy Docker test/build invocations exceeded the harness 30-second command-return limit before a final result. CI should run the normal multi-architecture image builds and test suites.

Rollout

This PR changes source build inputs only. Rebuild and publish the images, then scan the published artifacts before promoting any image tags through GitOps. No deployed tags are claimed fixed by this PR.

Plural Service: mgmt/console

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create one remediation PR for the currently fixable vulnerabilities in the deployed mgmt/console service artifacts owned by this repository. Do not change GitOps manifests or any deployed image tags; images will be rebuilt and published before promotion....
🔗 Run history	View run history

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​golang.org/​x/​net@​v0.60.0
	golang/​golang.org/​x/​sync@​v0.23.0

View full report

[soffi-ai]

Soffi AI Summary

This PR remediates known security vulnerabilities in the build inputs for two deployed artifacts — ghcr.io/pluralsh/kubernetes-agent and ghcr.io/pluralsh/deployment-controller — without touching any GitOps manifests or currently-deployed image tags.

The changes target three vulnerability classes:

1. Go standard library CVEs: The Go workspace toolchain directive and all in-scope module builder images are raised to Go 1.27.3.
2. golang.org/x/net vulnerabilities: go/kubernetes-agent (api + kas) and go/controller are updated to resolve x/net v0.60.0, along with companion x/* packages (crypto, mod, sync, sys, term, text) bumped to their corresponding latest versions.
3. github.com/klauspost/compress vulnerability: go/kubernetes-agent (api + kas) and go/controller now resolve v1.18.7.

Additionally, the Kubernetes agent final distroless base image digest is pinned to a current multi-architecture Debian 12 digest, refreshing OS-level scanner findings on rebuild.

Only go.mod, go.sum, and Dockerfile files are modified — no application logic is changed. The fixes are build-input-only; published images must be rebuilt, scanned, and promoted through the normal GitOps pipeline before any running workloads are considered remediated.

Changes

Security vulnerability remediation for Go dependencies and base images

• Bumps Go toolchain to 1.27.3, upgrades golang.org/x/net to v0.60.0, github.com/klauspost/compress to v1.18.7, and companion x/* packages across go/controller, go/kubernetes-agent/api, and go/kubernetes-agent/kas. Also pins the distroless Debian 12 final base image to a current digest in the kubernetes-agent Dockerfile to refresh OS-level scanner findings. (5374cd9)

---

Updated: 2026-10-23 17:08 UTC

Deploy in Soffi

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable regression was established.

Summary

Updates build inputs for the deployment-controller and combined kubernetes-agent images.

• Future Kubernetes Agent builds use updated Go inputs and a pinned Debian base.
• Future deployment-controller builds use Go 1.27.3 and refreshed dependency records.

No actionable issue was established. Tests and production image builds were not run during this review.

_{Reviews (1) · Last reviewed commit: "fix(security): remediate console artifac..." · Reviewed by Greptile}