[rcooney-sh]

Clears two Aikido findings on go.mod so the default-branch rescan stops reporting them:

• SEC-694 / GHSA-hrxh-6v49-42gf: google.golang.org/grpc v1.79.3 -> v1.83.2 (latest v1.83.x patch).
• SEC-695: end-of-life Go directive, go 1.25.5 -> go 1.26.0.

-go 1.25.5
+go 1.26.0
...
-	google.golang.org/grpc v1.79.3
+	google.golang.org/grpc v1.83.2

go get pulled grpc's minimum requirements along with it: go.opentelemetry.io/otel (+ metric, sdk, sdk/metric, trace) v1.40.0 -> v1.44.0, golang.org/x/{crypto,mod,net,sync,sys,term,text} and google.golang.org/genproto/googleapis/{api,rpc} to their newer releases. go mod tidy and go mod vendor were run with Go 1.26, so vendor/ and vendor/modules.txt match (the validate-vendor bake target runs the same commands).

No other Go pins needed changing: Dockerfile, hack/dockerfiles/*.Dockerfile, frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile, and the GO_VERSION env in buildkit.yml, frontend.yml, and test-os.yml are already on 1.26. This PR does not touch Dockerfile, so it does not overlap with #38 (SEC-701).

After merge, a new v0.29.x-blacksmith tag is needed for the shipped buildkitd binaries to include the fix.

Promotion risk: Medium. The toolchain does not change: v0.29.6-blacksmith is already built with go1.26.8 from golang:1.26-alpine. But this buildkitd runs inside every customer Docker build that uses setup-docker-builder, and it picks up four grpc minor versions on the server side plus three Go 1.26 GODEBUG default flips.

• Runtime change: grpc 1.79.3 -> 1.83.2 changes server behavior. HTTP/2 write buffers are pooled by default (1.80), the server stops reading a connection after 100 queued control frames (1.82.1), and requests with neither :authority nor Host get HTTP 400 (1.83.2). The go 1.26.0 directive flips the binary's DefaultGODEBUG from cryptocustomrand=1,tlssecpmlkem=0,urlstrictcolons=0 to the Go 1.26 defaults. otel moves 1.40 -> 1.44 and x/net moves 0.51 -> 0.58. The autofix commits are refactors with identical behavior: new(expr) replaces pointer helpers, and the HEALTHCHECK history string is checked byte-identical to the old %q output.
• What could break:
  • urlstrictcolons=1: a registry, mirror, or proxy URL with a bare colon in the host (http://host:1:2, unbracketed IPv6) now fails to parse. Pull/push fails with a URL parse error.
  • tlssecpmlkem=1: two more post-quantum groups are advertised in the TLS ClientHello. A broken registry or proxy middlebox could time out the handshake. Escape hatch: GODEBUG=tlssecpmlkem=0.
  • Control-frame throttle: under heavy session or filesync multiplexing, a client could stall instead of erroring. Tunable via GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
  • Pooled write buffers: buildkitd RSS and GC profile shift under concurrent builds.
  • grpc-go clients (buildx, buildctl, gateway frontends) always send :authority, so the 400 rejection should not hit them.
• Evidence: Proof built buildkitd and buildctl from e5f8e16. govulncheck reports no grpc advisories, tidy + vendor produce no changes, and a Dockerfile build with a RUN step succeeded over gRPC. That was one small local build. It did not cover a Blacksmith VM, sticky disk, setup-docker-builder, registry TLS or push, concurrency, GC/prune, or graceful shutdown. Repo CI (unit, integration, validate) had not finished on the current head when this was written. Earlier heads only failed Go 1.26 lint/vet, which the autofix commits fix.
• Blast radius / rollback / watch: Merging alone changes nothing that runs. The change ships only after v0.29.7-blacksmith is tagged and published, FastActions/fa bumps its pin (agent/Makefile, MODULE.bazel, BUILD.bazel), and an agent release reaches runner hosts through production.ini. From then on, every customer job using setup-docker-builder / build-push-action is affected. Roll out to [canary] first. To roll back, re-roll hosts to the previous agent tag, or revert the fa pin to v0.29.6-blacksmith; the buildkit repo needs nothing. After rollout, watch setup-docker-builder failures (buildkitd process has crashed, SIGKILL after graceful shutdown, sticky disk commit errors), registry TLS/handshake and URL parse errors in build logs, buildkitd memory per job, and Docker build duration.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

buildkitd binary links grpc v1.83.2 and Go 1.26

The rebuilt buildkitd moves from Go 1.25.5 / grpc v1.79.3 to Go 1.26.0 / grpc v1.83.2, and govulncheck no longer flags any grpc advisory, GHSA-hrxh-6v49-42gf included.

_Merge-base

_{This PR e5f8e16c}

Also checked · 2 more claims, all matched observations

vendor/ matches go.mod after tidy + vendor
buildctl builds against upgraded buildkitd over gRPC

_{Proof on e5f8e16c}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled. (Staging)}

[cursor]

This PR is too large for Bugbot to review. It changes 65,835 lines and 3,767,017 characters. Split the change into smaller pull requests to get a review.

[linear-code]

SEC-695

SEC-694

SEC-734