[19.0] Bump BUILDER_IMAGE_REVISION to 5.60.6

What does this MR do and why?

Bumps BUILDER_IMAGE_REVISION to 5.60.6 on 19-0-stable. Builder 5.60.6 moves the Go toolchain to 1.26.10 (the Go fix for the eMudhra/emSign CA compromise, CVE-2026-111943) and forces GOFIPS140=off so FIPS (boringcrypto) builds keep working. Pairs with the cacerts 2026.10.20 backport !9978 (merged).

Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/work_items/10160+s

Related https://gitlab.com/gitlab-org/release/tasks/-/work_items/28133+s

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

  • This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
  • The original MR has been deployed to GitLab.com (not applicable for documentation or spec changes).
  • This MR has a severity label assigned (if applicable).

Note to the merge request author and maintainer

If you have questions about the patch release process, please:

Edited by Robert Marshall

Merge request reports

Loading
Loading