fix(security): remediate git-server runtime dependencies

[plural-copilot]

Deployment context

• Service inventory finding: mgmt/console
• Affected image: ghcr.io/pluralsh/git-server:v0.12.47

Remediation

• Runtime/base: alpine:edge → alpine:3.23, with explicit expat=2.8.5-r0. Alpine's expat package installs libexpat, remediating libexpat 2.8.4-r0 → 2.8.5-r0 deterministically.
• Go: golang.org/x/crypto v0.53.0 → v0.56.0, covering CVE-2026-78662, CVE-2026-56855, and CVE-2026-56854.
• Resolved compatible indirect Go dependencies were updated as required: x/net 0.56.0 → 0.57.0, x/sync 0.21.0 → 0.22.0, x/sys 0.46.0 → 0.47.0, x/text 0.39.0 → 0.41.0, and x/tools 0.47.0 → 0.48.0; go.sum records the corresponding x/mod 0.38.0 and x/term 0.45.0 checksums.

Validation

Passed using Docker/DinD:

• go mod verify — all modules verified
• go mod tidy -diff — passed with no diff
• go list -m golang.org/x/crypto — golang.org/x/crypto v0.56.0
• docker build --no-cache -t soft-serve-libexpat-validation:local . — passed; installed libexpat (2.8.5-r0)
• docker run --rm --entrypoint sh soft-serve-libexpat-validation:local -ec 'apk info -e expat=2.8.5-r0; apk info -e libexpat=2.8.5-r0; apk info -W /usr/lib/libexpat.so.1' — passed; ownership reported libexpat-2.8.5-r0
• go test ./pkg/config/... ./pkg/ssh/... — pkg/config passed; the remaining SSH portion was stopped while the container was fetching github.com/matryer/is, so it is not claimed as complete.

Scope and residuals

• GO-2026-5932 is intentionally excluded because no fixed version is available.
• No pluralsh/console image build wiring, image tag, GitOps deployment configuration, Redis, or cloud-query-db changes are included.
• Existing open PRs fix(security): remediate Git-server build dependencies #38–fix(deps): upgrade golang.org/x/crypto to v0.56.0 #41 were inspected before this change: fix(security): remediate Git-server build dependencies #38 pins the prior 2.8.4-r0 package and fix(deps): upgrade golang.org/x/crypto to v0.56.0 #39–fix(deps): upgrade golang.org/x/crypto to v0.56.0 #41 are crypto-only; this PR supplies the distinct requested combined 2.8.5-r0 remediation.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create one focused remediation PR in this repository for the live mgmt/console service inventory finding in image ghcr.io/pluralsh/git-server:v0.12.47....
🔗 Run history	View run history

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang.org/​x/​crypto@​v0.53.0 ⏵ v0.56.0
	golang.org/​x/​sync@​v0.21.0 ⏵ v0.22.0	+1

View full report