fix(security): remediate PLATFOR-404 container vulnerability findings

[PrestigePvP]

Dependency and base-image version bumps, plus a vulnerability-scan CI check.

• Bump golang.org/x/crypto 0.47.0 → 0.52.0
• Bump golang.org/x/net 0.49.0 → 0.55.0
• Bump github.com/jackc/pgx/v5 5.9.0 → 5.9.2
• Bump Go toolchain 1.25.9 → 1.25.10 (go.mod + CI workflows)
• Upgrade musl/musl-utils in docker/alpine
• Add a report-only govulncheck CI workflow

Verified locally: go build ./... and govulncheck ./... pass.

[linear]

PLATFOR-404

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-246-fix-security-remediate-platfor-404-xray-container-findings

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[greptile-apps]

Greptile Summary

This PR remediates JFrog Xray container findings against infisical/cli:0.43.87 by bumping key Go dependencies and the Go toolchain, upgrading musl/musl-utils in the Docker Alpine image, and adding a report-only govulncheck CI workflow to surface future vulnerabilities on PRs without blocking merges.

• Dependency bumps: golang.org/x/crypto → 0.52.0 (9 SSH CVEs), golang.org/x/net → 0.55.0 (IDNA Punycode + HTTP/2 SETTINGS loop), github.com/jackc/pgx/v5 → 5.9.2 (SQLi in query sanitizer, unreachable from this codebase but cleared for scan gate), plus several indirect deps (sys, term, sync, text, mod, tools) that track the major bumps.
• Go toolchain: go.mod directive and all 7 CI workflow files updated from 1.25.9 → 1.25.10, clearing stdlib findings (NUL panic, net/mail DoS, HTTP/2, GOTOOLCHAIN checksum bypass).
• Docker: musl and musl-utils added to the apk upgrade step to pull the CVE-2026-40200 qsort stack-corruption fix at musl 1.2.5-r12.

Confidence Score: 4/5

Safe to merge — all changes are dependency version bumps and CI workflow additions with no application logic modified.

The diff touches only go.mod/go.sum, Docker, and CI workflows. All Go source-level security fixes come from upstream packages rather than any in-repo code change. The new govulncheck workflow runs with CGO_ENABLED=0, which may produce a slightly different reachability picture than the production build, and lacks module caching; both are easy follow-ups. No application code is modified, so regression risk from the dep bumps is low.

.github/workflows/govulncheck.yml — the new scan workflow benefits from adding module caching and aligning the CGO_ENABLED setting with how production binaries are built.

Important Files Changed

Filename	Overview
.github/workflows/govulncheck.yml	New report-only govulncheck CI workflow; missing Go module cache configuration compared to other workflows
go.mod	Security-driven dependency bumps: golang.org/x/crypto 0.47 to 0.52, golang.org/x/net 0.49 to 0.55, pgx/v5 5.9.0 to 5.9.2, and several indirect deps; Go toolchain directive updated to 1.25.10
go.sum	Checksums updated consistently for all bumped modules; no orphaned or conflicting entries observed
docker/alpine	Adds musl and musl-utils to the apk upgrade command to pull the CVE-2026-40200 fix at musl 1.2.5-r12
.github/workflows/release_build_infisical_cli.yml	Go version bumped from 1.25.9 to 1.25.10 in all three setup-go steps; no other changes

_{Reviews (1): Last reviewed commit: "fix(security): remediate PLATFOR-404 Xra..." | Re-trigger Greptile}