Close CVEs: bump Go toolchain to 1.26.4 and UI dep overrides

Artyom Kartasovrequested to merge
cve/close-cves-20260617 into master

Summary

Closes outstanding dependency CVEs surfaced by the weekly CVE pipeline and the Mend bot.

Go

  • Bump CI/Docker Go build images 1.26.2/1.26.3 → 1.26.4 (engine/.gitlab-ci.yml, .gitlab-ci-security.yml, engine/Dockerfile.dblab-server-debug). The release binary is built by build-binary-alpine, so this is what ships.
  • Closes 9 reachable + 8 imported Go stdlib advisories reported by govulncheck (GO-2026-4866/4869/4870/4918/4946/4947/4971/5037/5039 and others).

UI

  • Add pnpm override form-data@>=4.0.0 <4.0.6 → >=4.0.6 (CVE-2026-12143, HIGH) and bump dompurify override to >=3.4.9.
  • Regenerated lockfile: form-data 4.0.4→4.0.6, dompurify 3.4.7→3.4.10. pnpm audit confirms both cleared.

Not addressed (no fix / non-reachable)

  • github.com/docker/docker GO-2026-4883/4887 — no upstream fix (v28.5.2 is latest); moby AuthZ-plugin path not reachable in DLE.
  • github.com/docker/cli CVE-2026-6406 — Docker Desktop ECI bypass via --use-api-socket, not in the Go vuln DB and not reachable (only cli/streams is imported).

Related

  • Closes #369 (closed) (form-data) once merged. 19 already-fixed Mend bot issues were closed separately (x/crypto, x/sys, qs, tmp, dompurify).

Merge request reports