`V1.1.0`: Update Go dependencies to address multiple CVEs

[samadalishah]

Summary

Outpost v1.1.0 is built with Go 1.26.4 and includes dependencies affected by the following security vulnerabilities.

CVE	Severity	Component	Description	Affected Version	Fixed Version
CVE-2026-39822	High	os.Root	On Unix systems, os.Root may incorrectly follow a symbolic link outside the configured root when the final path component is a symlink and the supplied path ends with /. This could allow access outside the intended filesystem root.	Go 1.26.4	Go 1.26.5
CVE-2026-42505	Medium	crypto/tls (ECH)	When using Encrypted Client Hello (ECH), TLS pre-shared key (PSK) identities could be exposed in the unencrypted outer ClientHello, allowing a passive observer to correlate or de-anonymize ECH connections.	Go 1.26.4	Go 1.26.5
CVE-2026-56852	High	golang.org/x/text	A denial-of-service vulnerability exists in golang.org/x/text where malformed UTF-8 input can trigger an infinite loop, causing excessive CPU usage and preventing request processing. Applications processing untrusted external input may be vulnerable to remote DoS attacks.	golang.org/x/text < 0.39.0	golang.org/x/text 0.39.0 or later

Recommended Remediation

• Rebuild Outpost using Go 1.26.5 or later.
• Update golang.org/x/text to 0.39.0 or later.
• Updating only the container base image is not sufficient, as the Go standard library is statically compiled into the Outpost binary.

Acceptance Criteria

• Outpost is rebuilt using Go 1.26.5 or newer.
• golang.org/x/text is upgraded to 0.39.0 or later.
• The resulting container image no longer reports these vulnerabilities.
• Existing webhook publishing, retries, HMAC signing, and auto-disable functionality continue to work as expected.

Risk Assessment

These vulnerabilities originate from the Go toolchain and dependencies used to build Outpost. Updating the Go version and golang.org/x/text dependency is recommended to ensure the container image no longer includes known vulnerable components.

[samadalishah]

Hello @alexluong
Sorry for tagging but just wanted to bring this issue to your attention. These CVEs were flagged by our security checks and while they are not really exploitable in our use cases, we would still like to fix them in the next release. Please let me know what you think and how to deal with such issues!
Thank you in advance!

[alexluong]

Hi @samadalishah, no worries and feel free to ping me directly. Sorry for delay on our end. It's on my TODO as I'm focusing on the OSS side and will be preparing for v1.1.1 soon. Will try to include this in that release as well.

I'll aim for a new release next week or so.