fix(security): remediate PROD-5210 dependency and image alerts

[plural-copilot]

Security remediation

Fixes PROD-5210

• Updates the selected Go module github.com/containerd/containerd from v1.7.35 to v1.7.36 using Go module tooling.
• Traces the CI path: build-image builds Dockerfile, publish-image creates the manifest, then its publish-image Trivy step scans that final image. The builder and final stages both use the validated supported golang:1.26.6-alpine3.24 line; only the final stage installs APK runtime packages.
• Makes final-stage APK selection deterministic at the security minima while retaining git and build-base: libssl3>=3.5.8-r0, libcrypto3>=3.5.8-r0, and libexpat>=2.8.5-r0. v3.24 repository validation confirmed availability of 3.5.8-r0 / 2.8.5-r0.

Alert mapping

• Dependabot Update module github.com/Azure/go-autorest/autorest/azure/auth to v0.5.11 #143: github.com/containerd/containerd v1.7.36.
• Trivy #1824, #1825, #1826, #1827, #1828, #1829, #1830, #1831, #1832, #1833, #1834, #1835, #1836, #1837, #1838, #1839, #1840, #1841, #1842, #1843, and #1856: final-image OpenSSL (libssl3/libcrypto3) and Expat (libexpat) package minima.

Validation

Passed:

docker run --rm -v "$PWD":/workspace -w /workspace golang:1.26.6-alpine3.24 sh -ec 'go mod verify'
git diff --check
docker run --rm golang:1.26.6-alpine3.24 sh -ec 'apk update >/dev/null; apk policy libssl3 libcrypto3 libexpat; apk add --simulate --no-cache "libssl3>=3.5.8-r0" "libcrypto3>=3.5.8-r0" "libexpat>=2.8.5-r0" git build-base'

The APK simulation selected libssl3 3.5.8-r0, libcrypto3 3.5.8-r0, and libexpat 2.8.5-r0.

Residual limitation: the actual docker build --pull --build-arg APP_VSN=verify --build-arg APP_COMMIT=local --build-arg APP_DATE=2026-09-27T00:00:00Z -t plural-cli-prod-5210:verify . stalled in builder go mod download; stopping it left the local Docker daemon unresponsive. Therefore focused Go test/build and final-image package inspection could not be completed locally; CI remains the required final validation.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create exactly one replacement remediation PR for Linear PROD-5210 in this repository. The user has already verified the repository and current main; start by inspecting current main and relevant build/module files. Do not reuse any old branch. Prior PR #804 is closed/unmerged; inspect its diff/history only if useful, and independently validate the correct solution....
🔗 Run history	View run history

[linear]

PROD-5210

[greptile-apps]

Confidence Score: 5/5

[High risk] Updates container base image and Go dependencies for security patches.

The PR appears safe to merge based on the reviewed changes.

Summary

The PR raises the indirect containerd dependency to v1.7.36 and adds minimum OpenSSL and Expat package versions to the final Docker image.

• CI builds and scans the final image; the builder stage is not published.
• No actionable regression or reachable security issue was identified in the changed code.

_{Reviews (1) · Last reviewed commit: "fix(security): remediate PROD-5210 alert..."}