[matthewmcneely]

Description

Fixes the failing ci-dgraph-nightly-cves scan on main
(run 39700727870). Trivy flagged 6 findings in
usr/local/bin/dgraph (1 CRITICAL, 5 HIGH); the ubuntu 24.04 base layer had none. Two parts:

• chore(vex): CVE-2026-102748 (CRITICAL) is GHSA-qj98-gp63-54xj, the unauthenticated Zero /removeNode DoS.
  The advisory went public on 2026-10-15 with a CVE assigned, and since Trivy reports the CVE ID, our statement keyed
  by the GHSA ID stopped matching. The fix (c32f604) is in every nightly build; the nightly pseudo-version
  (v25.0.0-2026...) just sorts below 25.4.0. Re-keyed the statement to the CVE with the GHSA as an alias, dropped
  the pre-emptive wording, and bumped the document version to 4.

• chore(deps): bumps golang.org/x/net v0.58.0 → v0.60.0 (CVE-2026-78669, HTTP/2 SETTINGS flood, reachable
  through the gRPC and Alpha HTTP servers) and raises the go directive to 1.27.3 for the four stdlib CVEs:

  CVE	Package	Fixed in
  CVE-2026-111943	crypto/x509	1.27.3
  CVE-2026-78667	net/http	1.27.2
  CVE-2026-78669	net/http2 (stdlib copy)	1.27.2
  CVE-2026-97031	crypto/tls	1.27.2

  This is a go directive bump, not a toolchain line, on purpose. A toolchain line is only a preference: builds
  that pin their Go with GOTOOLCHAIN=local, like FIPS builders, ignore it and quietly ship the 1.27.0 stdlib.
  Requiring 1.27.3 makes those builds fail with go.mod requires go >= 1.27.3 until they upgrade. The cost is that
  importers of dgraph/v25 need Go 1.27.3, which is the security release anyway. Every workflow reads
  go-version-file, so cd-dgraph and the nightly scan build with 1.27.3 without workflow changes, and the root
  Dockerfile builder moves to golang:1.27.3. The x/net bump also pulls crypto, mod, sync, sys, term, text and
  tools forward.

Validation

• make dgraph builds and the binary reports go1.27.3. With GOTOOLCHAIN=local on Go 1.27.0 the build now fails
  with go.mod requires go >= 1.27.3 (running go 1.27.0; GOTOOLCHAIN=local).
• govulncheck ./... shows no stdlib or x/net findings. The remaining reachable hits are in github.com/docker/docker
  (no fix available), which only the test harness uses; it isn't linked into the dgraph binary.
• Trivy against a Linux build from a tagless shallow clone, which produces the same v25.0.0-... pseudo-version CI
  does: 8 findings without VEX, all in dgraph's own module; 0 with --vex openvex.json (exit 0).

Once this lands, a workflow_dispatch run of ci-dgraph-nightly-cves should confirm the scan is green.

Checklist

• The PR title follows the
  Conventional Commits syntax, leading
  with fix:, feat:, chore:, ci:, etc.
• Code compiles correctly and linting (via trunk) passes locally

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• Chores
  • Updated the Go toolchain and several Go dependencies, including the version used to build the Docker image.
• Documentation
  • Updated the vulnerability advisory with a CVE identifier and clarified that it applies only to nightly CI builds using Go versions below 25.4.0.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3ba7cbda-6ab4-4b4c-8fd3-35c66fc80106

📥 Commits

Reviewing files that changed from the base of the PR and between f2f4303 and ecf956d.

📒 Files selected for processing: 2

• Dockerfile
• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

The Go toolchain directive and selected module versions are updated. The OpenVEX document receives a new timestamp and version, and its vulnerability statement now identifies CVE-2026-102748 and describes affected nightly CI builds.

Changes: Go toolchain and dependencies

Layer / File(s)	Summary
Toolchain and module version updates go.mod	Adds the Go 1.27.3 toolchain directive and upgrades selected direct and indirect golang.org/x dependencies.

OpenVEX vulnerability record

Layer / File(s)	Summary
Vulnerability statement update openvex.json	Updates the document timestamp and version. The statement identifies CVE-2026-102748, lists GHSA-qj98-gp63-54xj as an alias, and describes nightly CI builds with pseudo-versions below the fixed 25.4.0 tag.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: shiva-istari

Merge Risk: ⚪ Minimal · up to ecf95

The reviewed toolchain, dependency, and vulnerability metadata updates are mergeable with normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely summarizes the main changes: clearing nightly CVE findings through a VEX re-key, an x/net upgrade, and Go 1.27.3 updates.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}