fix: remediate Hub ECR image vulnerabilities

[BhagyaAmarasinghe]

Summary

• upgrade the Go modules tied to the active AWS Inspector findings: OpenTelemetry, gRPC, golang.org/x/net, and golang.org/x/text
• align related transitive modules and refresh go.sum
• pin the fixed versions in Docker's separate migration-tools module so the bundled goose and river binaries do not reintroduce vulnerable packages

Root cause

The 0.8.2 ECR image embeds affected Go module versions in both the Hub binaries and the separately built migration tools. Updating only go.mod would leave Inspector findings in the goose/river layer.

This addresses the four unique active Inspector advisories reported for both amd64 and arm64 child manifests:

• GHSA-hrxh-6v49-42gf (google.golang.org/grpc)
• CVE-2026-46600 (golang.org/x/net)
• CVE-2026-56852 (golang.org/x/text)
• CVE-2026-41178 (go.opentelemetry.io/otel)

Validation

• go mod verify — passed
• make fmt — passed
• make lint — passed with zero issues
• make test-unit — passed
• make build — passed for hub-api and hub-worker
• govulncheck ./... — zero affected vulnerabilities
• Docker migration-tool module resolved the fixed dependency versions and cross-compiled goose and river for linux/amd64 and linux/arm64

A full Docker image build could not run locally because the configured OrbStack Docker socket was unavailable. Integration tests were not run because they require a pgvector test database. The PR remains draft pending CI/container-build evidence.

[xernobyl]

Thank you for the PR, LGTM.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 98ad26b4-05de-44c3-bfa7-74ba51a58754

📥 Commits

Reviewing files that changed from the base of the PR and between e5a2f16 and 8ef5ac3.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• Dockerfile
• go.mod

---

Walkthrough

Updated direct and indirect OpenTelemetry, gRPC, Google genproto, and golang.org/x module versions in go.mod. Updated Docker builder-stage version arguments and migration-tool installation pins to align with the refreshed dependencies, including OpenTelemetry and golang.org/x/text.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise, Conventional Commits-style, and accurately summarizes the vulnerability remediation.
Description check	✅ Passed	The PR description includes summary, root cause, and validation details, but omits the required Fixes issue reference and checklist items.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}