Remediate Go and embedded Python CVEs

[LouisLotter]

Bumps Go to 1.26.6, updates golang.org/x/mod and its compatible x/* set, and upgrades embedded Python to 3.13.15. Also repairs the Python updater after the Bazel migration so future patch bumps update the actual runtime source.

Validation:

• focused updater/module/release-note tests
• targeted Ruff format and lint checks
• release-note lint
• idempotent Go workspace tidy and Python updater
• cluster-agent build and process-agent compile

Fixes #461
Related: StackVista/cve-reporter#29

[Copilot]

Pull request overview

This PR focuses on clearing CVE scan gate failures by upgrading the repo’s Go toolchain and aligned golang.org/x/* dependencies, and by bumping the embedded CPython runtime used by the agent. It also updates the Python version updater to work with the Bazel-based CPython source of truth.

Changes:

• Bump the Go toolchain to 1.26.6 (workspace/tooling) and update various build/dev container images and scripts accordingly.
• Update golang.org/x/mod to v0.40.0 and refresh the compatible golang.org/x/* set (e.g., x/net, x/sys, x/crypto, x/tools, etc.) across many submodules.
• Upgrade embedded Python to 3.13.15, update E2E expectations, and fix the Python updater to read/write the Bazel CPython definition.

Reviewed changes

Copilot reviewed 146 out of 265 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.go-version	Bump pinned Go toolchain version to 1.26.6
.wwhrd.yml	Update Go license URL to match the bumped Go version
cmd/process-agent/README.md	Update documented minimum Go version
comp/api/api/def/go.mod	Refresh golang.org/x/sys indirect pin (x/* set alignment)
comp/api/api/def/go.sum	Refresh checksums for updated x/* dependencies
comp/core/agenttelemetry/def/go.mod	Refresh golang.org/x/sys indirect pin
comp/core/agenttelemetry/def/go.sum	Refresh checksums for updated x/* dependencies
comp/core/agenttelemetry/fx/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/agenttelemetry/impl/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/config/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
comp/core/config/go.sum	Refresh checksums for updated x/* dependencies
comp/core/configsync/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/delegatedauth/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/delegatedauth/api/cloudauth/aws/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/flare/types/go.mod	Refresh golang.org/x/sys indirect pin
comp/core/flare/types/go.sum	Refresh checksums for updated x/* dependencies
comp/core/hostname/hostnameinterface/go.mod	Refresh golang.org/x/sys indirect pin
comp/core/hostname/hostnameinterface/go.sum	Refresh checksums for updated x/* dependencies
comp/core/ipc/httphelpers/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/ipc/impl/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/ipc/mock/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/log/fx/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
comp/core/log/fx/go.sum	Refresh checksums for updated x/* dependencies
comp/core/log/impl/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
comp/core/log/impl/go.sum	Refresh checksums for updated x/* dependencies
comp/core/log/impl-trace/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
comp/core/secrets/fx/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/secrets/impl/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/secrets/noop-impl/go.mod	Refresh golang.org/x/{sys,text} indirect pins
comp/core/secrets/noop-impl/go.sum	Refresh checksums for updated x/* dependencies
comp/core/status/go.mod	Refresh golang.org/x/{sys,text} indirect pins
comp/core/status/go.sum	Refresh checksums for updated x/* dependencies
comp/core/status/statusimpl/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/core/tagger/def/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
comp/core/tagger/def/go.sum	Refresh checksums for updated x/* dependencies
comp/core/tagger/fx-remote/go.mod	Refresh golang.org/x/{crypto,net,sync,sys,text} indirect pins
comp/core/tagger/impl-remote/go.mod	Refresh golang.org/x/{crypto,net,sync,sys,text} indirect pins
comp/core/tagger/subscriber/go.mod	Refresh golang.org/x/sys indirect pin
comp/core/tagger/subscriber/go.sum	Refresh checksums for updated x/* dependencies
comp/core/tagger/telemetry/go.mod	Refresh golang.org/x/sys indirect pin
comp/core/tagger/telemetry/go.sum	Refresh checksums for updated x/* dependencies
comp/core/telemetry/go.mod	Refresh golang.org/x/sys indirect pin
comp/core/telemetry/go.sum	Refresh checksums for updated x/* dependencies
comp/forwarder/defaultforwarder/go.mod	Refresh golang.org/x/{sync,net,sys,text} pins
comp/forwarder/orchestrator/orchestratorinterface/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/logs-library/go.mod	Refresh golang.org/x/sys indirect pin
comp/logs-library/go.sum	Refresh checksums for updated x/* dependencies
comp/logs/agent/config/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/netflow/payload/go.mod	Bump module Go version directive to 1.26.0
comp/otelcol/collector-contrib/def/go.mod	Refresh golang.org/x/{net,sys,text} indirect pins
comp/otelcol/collector-contrib/impl/go.mod	Refresh golang.org/x/{crypto,mod,net,sync,sys,term,text,tools} indirect pins
comp/otelcol/converter/def/go.mod	Bump module Go version directive to 1.26.0
comp/otelcol/converter/impl/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
comp/otelcol/ddflareextension/def/go.mod	Bump module Go version directive to 1.26.0
comp/otelcol/ddflareextension/impl/go.mod	Refresh golang.org/x/{crypto,mod,net,sync,sys,term,text,tools} indirect pins
comp/otelcol/ddflareextension/types/go.mod	Bump module Go version directive to 1.26.0
comp/otelcol/ddprofilingextension/impl/go.mod	Refresh golang.org/x/{crypto,mod,net,sync,sys,term,text} indirect pins
comp/otelcol/logsagentpipeline/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/otelcol/logsagentpipeline/logsagentpipelineimpl/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/otelcol/otlp/components/exporter/datadogexporter/go.mod	Refresh golang.org/x/{crypto,net,sync,sys,text} indirect pins
comp/otelcol/otlp/components/exporter/logsagentexporter/go.mod	Refresh golang.org/x/{crypto,net,sync,sys,text} indirect pins
comp/otelcol/otlp/components/exporter/serializerexporter/go.mod	Refresh golang.org/x/{net,crypto,sync,sys,text} pins
comp/otelcol/otlp/components/metricsclient/go.mod	Refresh golang.org/x/sys indirect pin
comp/otelcol/otlp/components/processor/infraattributesprocessor/go.mod	Refresh golang.org/x/{crypto,net,sync,sys,text} indirect pins
comp/otelcol/otlp/testutil/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
comp/otelcol/status/def/go.mod	Bump module Go version directive to 1.26.0
comp/otelcol/status/impl/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
comp/serializer/logscompression/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
comp/serializer/logscompression/go.sum	Refresh checksums for updated x/* dependencies
comp/serializer/metricscompression/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
comp/serializer/metricscompression/go.sum	Refresh checksums for updated x/* dependencies
comp/trace/agent/def/go.sum	Refresh checksums for updated x/* dependencies
deps/cpython/cpython.MODULE.bazel	Bump Bazel-managed CPython to 3.13.15 and update archive SHA256
devenv/scripts/Install-DevEnv.ps1	Update Windows dev environment installer to Go 1.26.6
go.mod	Bump module Go version to 1.26.0 and update golang.org/x/* dependency set
go.work	Bump workspace Go version to 1.26.6
internal/tools/go.mod	Bump tools module Go version and refresh golang.org/x/* indirect pins
internal/tools/gotest-custom/go.mod	Bump tools submodule Go version directive
internal/tools/independent-lint/go.mod	Bump Go version and golang.org/x/mod to v0.40.0
internal/tools/independent-lint/go.sum	Refresh checksums for updated x/mod
internal/tools/modformatter/go.mod	Bump Go version and golang.org/x/mod to v0.40.0
internal/tools/modformatter/go.sum	Refresh checksums for updated x/mod
internal/tools/modparser/go.mod	Bump Go version and golang.org/x/mod to v0.40.0
internal/tools/modparser/go.sum	Refresh checksums for updated x/mod
internal/tools/proto/go.mod	Bump Go version and refresh golang.org/x/* indirect pins
internal/tools/worksynchronizer/go.mod	Bump Go version and golang.org/x/mod to v0.40.0
internal/tools/worksynchronizer/go.sum	Refresh checksums for updated x/mod
omnibus/config/software/python3.rb	Bump omnibus metadata Python version to 3.13.15 (Bazel-backed build)
pkg/api/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
pkg/config/create/go.mod	Refresh golang.org/x/sys indirect pin
pkg/config/create/go.sum	Refresh checksums for updated x/sys
pkg/config/env/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
pkg/config/env/go.sum	Refresh checksums for updated x/{net,sync,sys}
pkg/config/helper/go.mod	Refresh golang.org/x/sys indirect pin
pkg/config/helper/go.sum	Refresh checksums for updated x/sys
pkg/config/mock/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
pkg/config/mock/go.sum	Refresh checksums for updated x/{net,sync,sys}
pkg/config/nodetreemodel/go.mod	Refresh golang.org/x/sys indirect pin
pkg/config/nodetreemodel/go.sum	Refresh checksums for updated x/sys
pkg/config/remote/go.mod	Bump module Go version and refresh golang.org/x/{crypto,net,sync,sys,text} pins
pkg/config/render_config/go.mod	Bump module Go version directive to 1.26.0
pkg/config/setup/go.mod	Refresh golang.org/x/{sys,net,sync} pins
pkg/config/setup/go.sum	Refresh checksums for updated x/{net,sync,sys}
pkg/config/structure/go.mod	Refresh golang.org/x/sys indirect pin
pkg/config/structure/go.sum	Refresh checksums for updated x/sys
pkg/config/utils/go.mod	Refresh golang.org/x/{net,sync,sys,text} pins
pkg/config/viperconfig/go.mod	Refresh golang.org/x/sys indirect pin
pkg/config/viperconfig/go.sum	Refresh checksums for updated x/sys
pkg/errors/go.mod	Bump module Go version directive to 1.26.0
pkg/fips/go.mod	Update golang.org/x/sys pin for Go 1.26 toolchain set
pkg/fips/go.sum	Refresh checksums for updated x/sys
pkg/fleet/installer/go.mod	Refresh golang.org/x/* indirect pins (incl. x/mod/x/tools)
pkg/gohai/go.mod	Update golang.org/x/sys pin
pkg/gohai/go.sum	Refresh checksums for updated x/sys
pkg/logs/client/go.mod	Refresh golang.org/x/{net,sync,sys,text} pins
pkg/logs/diagnostic/go.mod	Refresh golang.org/x/{net,sync,sys,text} pins
pkg/logs/launchers/windowsevent/README.md	Update documented Go version prerequisite
pkg/logs/message/go.mod	Refresh golang.org/x/{net,sync,sys,text} pins
pkg/logs/metrics/go.mod	Refresh golang.org/x/sys indirect pin
pkg/logs/metrics/go.sum	Refresh checksums for updated x/sys
pkg/logs/pipeline/go.mod	Refresh golang.org/x/{net,sync,sys,text} pins
pkg/logs/processor/go.mod	Refresh golang.org/x/{net,sync,sys,text} pins
pkg/logs/sender/go.mod	Refresh golang.org/x/{net,sync,sys,text} pins
pkg/logs/sources/go.mod	Refresh golang.org/x/{net,sync,sys,text} pins
pkg/logs/util/testutils/go.mod	Refresh golang.org/x/{net,sync,sys,text} pins
pkg/metrics/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
pkg/metrics/go.sum	Refresh checksums for updated x/{net,sync,sys}
pkg/network/driver/go.mod	Bump module Go version and update golang.org/x/sys pin
pkg/network/driver/go.sum	Refresh checksums for updated x/sys
pkg/network/payload/go.mod	Bump module Go version directive to 1.26.0
pkg/networkdevice/profile/go.mod	Bump module Go version directive to 1.26.0
pkg/networkpath/payload/go.mod	Bump module Go version directive to 1.26.0
pkg/obfuscate/go.mod	Refresh golang.org/x/{net,sys} indirect pins
pkg/opentelemetry-mapping-go/otlp/attributes/go.mod	Refresh golang.org/x/sys indirect pin
pkg/opentelemetry-mapping-go/otlp/attributes/go.sum	Refresh checksums for updated x/sys
pkg/opentelemetry-mapping-go/otlp/logs/go.mod	Refresh golang.org/x/sys indirect pin
pkg/opentelemetry-mapping-go/otlp/logs/go.sum	Refresh checksums for updated x/sys
pkg/opentelemetry-mapping-go/otlp/metrics/go.mod	Refresh golang.org/x/sys indirect pin
pkg/opentelemetry-mapping-go/otlp/metrics/go.sum	Refresh checksums for updated x/sys
pkg/process/util/api/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
pkg/proto/go.mod	Refresh golang.org/x/{net,sys,text} indirect pins
pkg/remoteconfig/state/go.mod	Update golang.org/x/crypto indirect pin
pkg/remoteconfig/state/go.sum	Refresh checksums for updated x/{crypto,sys}
pkg/security/secl/go.mod	Bump module Go version and refresh golang.org/x/{sys,text,net,sync} pins
pkg/security/seclwin/go.mod	Bump module Go version and refresh golang.org/x/{net,sync,sys,text} pins
pkg/security/seclwin/go.sum	Refresh checksums for updated x/{net,sync,sys,text}
pkg/serializer/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
pkg/ssi/testutils/go.mod	Bump module Go version and refresh golang.org/x/{net,text} pins
pkg/ssi/testutils/go.sum	Refresh checksums for updated x/{net,text}
pkg/telemetry/go.mod	Refresh golang.org/x/sys indirect pin
pkg/telemetry/go.sum	Refresh checksums for updated x/sys
pkg/trace/go.mod	Update golang.org/x/sys and refresh golang.org/x/{net,sync,text} indirect pins
pkg/trace/otel/go.mod	Refresh golang.org/x/{crypto,net,sync,sys,text} indirect pins
pkg/trace/stats/go.mod	Refresh golang.org/x/sys indirect pin
pkg/util/aws/creds/go.mod	Refresh golang.org/x/{net,sync,sys,text} indirect pins
pkg/util/cgroups/go.mod	Refresh golang.org/x/sys indirect pin
pkg/util/cgroups/go.sum	Refresh checksums for updated x/sys
pkg/util/compression/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
pkg/util/compression/go.sum	Refresh checksums for updated x/{net,sync,sys}
pkg/util/defaultpaths/go.mod	Refresh golang.org/x/{sys,net,sync} pins
pkg/util/defaultpaths/go.sum	Refresh checksums for updated x/{net,sync,sys}
pkg/util/filesystem/go.mod	Refresh golang.org/x/{sync,sys} pins
pkg/util/filesystem/go.sum	Refresh checksums for updated x/{sync,sys}
pkg/util/flavor/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
pkg/util/flavor/go.sum	Refresh checksums for updated x/{net,sync,sys}
pkg/util/fxutil/go.mod	Update golang.org/x/sys indirect pin
pkg/util/fxutil/go.sum	Refresh checksums for updated x/sys
pkg/util/grpc/go.mod	Refresh golang.org/x/{crypto,net,sync,sys,text} indirect pins
pkg/util/hostinfo/go.mod	Update golang.org/x/sys pin
pkg/util/hostinfo/go.sum	Refresh checksums for updated x/sys
pkg/util/http/go.mod	Refresh golang.org/x/{net,sync,sys,text} pins
pkg/util/kubernetes/apiserver/common/namespace/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
pkg/util/log/setup/go.mod	Refresh golang.org/x/{net,sync,sys} indirect pins
pkg/util/log/setup/go.sum	Refresh checksums for updated x/{net,sync,sys}
pkg/util/otel/go.sum	Refresh checksums for updated x/sys
pkg/util/prometheus/go.mod	Bump module Go version and refresh golang.org/x/{net,text} indirect pins
pkg/util/system/go.mod	Refresh golang.org/x/{sys,net,sync} pins
pkg/util/system/go.sum	Refresh checksums for updated x/{net,sync,sys}
pkg/util/uuid/go.mod	Update golang.org/x/sys pin
pkg/util/uuid/go.sum	Refresh checksums for updated x/sys
pkg/util/winutil/go.mod	Update golang.org/x/sys pin
pkg/util/winutil/go.sum	Refresh checksums for updated x/sys
releasenotes/notes/issue-461-go-toolchain-cve-remediation-a91e461c4fe16a66.yaml	Add release note describing security remediations
tasks/go.py	Update Go version parsing comment to match 1.26.6
tasks/python_version.py	Fix updater to use Bazel CPython file as version source and update Bazel SHA256 correctly
tasks/unit_tests/modules_tests.py	Update module tests fixture to expect Go 1.26
test/e2e-framework/go.mod	Bump module Go version and refresh golang.org/x/* indirect pins
test/fakeintake/Dockerfile	Bump fakeintake build Go image to 1.26.6
test/fakeintake/docs/README.md	Update documented Go requirement to 1.26
test/fakeintake/go.mod	Bump module Go version and refresh golang.org/x/{sys,text} pins
test/fakeintake/go.sum	Refresh checksums for updated x/{sys,text}
test/new-e2e/go.mod	Bump module Go version and refresh golang.org/x/* pins (incl. x/mod v0.40.0)
test/new-e2e/tests/agent-platform/common/agent_behaviour.go	Update expected embedded Python version constant to 3.13.15
test/otel/go.mod	Refresh golang.org/x/* pins for the otel test module
tools/build-ddot-byoc/go.mod	Bump module Go version and refresh golang.org/x/{sync,sys} pins
tools/build-ddot-byoc/go.sum	Refresh checksums for updated x/{sync,sys}
tools/gdb/Dockerfile	Update downloaded Go toolchain tarball to 1.26.6
tools/host-profiler/Dockerfile	Bump base Go image to 1.26.6
tools/retry_file_dump/go.mod	Bump module Go version directive to 1.26.0

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[LouisParkin]

Two hard blockers on the VEX exception side, one medium follow-up on the GODEBUG deferral, and a nit. One FYI with no action needed.

[BLOCKER] 10 Python CVE exceptions must be removed

exceptions/stackstate-k8s-agent/CVE-2026-1502.yaml, CVE-2026-3276.yaml, CVE-2026-3298.yaml, CVE-2026-4786.yaml, CVE-2026-6019.yaml, CVE-2026-6100.yaml, CVE-2026-7210.yaml, CVE-2026-7774.yaml, CVE-2026-8328.yaml, CVE-2026-9669.yaml

All ten have status: under_investigation / reason: omnibus_runtime_bump_in_progress and state: "it must not be renewed without re-checking whether 3.13.14 has been integrated." This PR integrates 3.13.15, which includes every 3.13.14 patch. The stated expiry condition has fired; these files must be deleted in this PR. Leaving them means the CVE gate still treats already-fixed findings as under investigation.

[BLOCKER] GO-2026-5932 exceptions have stale purls and need verification

exceptions/stackstate-k8s-agent/GO-2026-5932.yaml:9 and exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml:9 both carry purl: pkg:golang/golang.org/x/crypto@v0.53.0. This PR bumps x/crypto to v0.55.0. Check the Go vuln DB: if v0.55.0 is listed as fixed, delete both files; if the openpgp exclusion argument still holds at v0.55.0, update the purl to v0.55.0.

[MEDIUM] Stale GODEBUG review obligation in go.work

go.work:5: // This should be revisited for go 1.25.x alongside godebug tlsmlkem=0. The team committed to re-evaluating whether to keep X25519MLKEM768 suppressed at Go 1.25 — that review never happened and we are now at 1.26.6. Either do the re-evaluation now (and update or remove the setting) or at minimum update the comment to record that the review was deferred again and why.

[FYI] Go 1.26.6 is one minor version ahead of upstream DataDog 7.78.x (1.25.9)

No action needed — intentional drift to pick up CVE fixes is fine. Just noting it for the next upstream rebase: toolchain-version differences between the fork and upstream will need care around any new GODEBUG defaults or build-constraint changes introduced in 1.26.

[NIT] tools/gdb/Dockerfile: Go download has no checksum

The curl line (changed in this PR to fetch 1.26.6) has no sha256sum check. Pre-existing pattern, but worth adding a checksum against the published hash while the line is being touched.

Dismissing: this review was posted in error by an automated agent and two of its blocker claims are incorrect. Replacing with a corrected comment review. Apologies for the noise.

[LouisParkin]

Dismissed my earlier review — an automated agent posted it in error and two of its "blockers" were wrong. Correcting the record first: do not delete the GO-2026-5932 exceptions. That advisory is the "x/crypto/openpgp is unmaintained" entry, introduced: 0 with no fixed version at any release, and CI confirms it still fires at v0.55.0 where it is currently suppressed. Removing it would turn a suppressed finding into an unmanaged one.

The substance here looks right. I verified the 3.13.15 sha256 against python.org (exact match); that 1.26.6 is genuinely required rather than gold-plating, since CVE-2026-46600 is fixed only in 1.26.6/1.27.0-rc.3 and not in 1.25.13; that the bump reaches the shipped binaries via go_sdk.from_file(go_work = "//:go.work"); and that the sqlite_win fixture in the updater test covers the exact two-match regex bug that let the runtime drift to 3.13.13 while omnibus said 3.13.14. Nice catch on the root cause.

One follow-up worth doing here rather than later:

Every one of the 26 exceptions expires 2026-08-20, and eight still suppress live findings. The evaluator fails the gate on expired exceptions the same way it does on unmanaged ones, so the branch goes red again on 2026-08-21. Two of the eight are cheap to clear while you are already bumping dependencies:

• klauspost/compress v1.18.5 → v1.18.7 clears GO-2026-5841.
• CVE-2026-69247 / 69249 record omnibus_runtime_bump_in_progress, but cryptography is a pip wheel installed by datadog-agent-integrations-py3.rb, not part of the CPython runtime — no interpreter bump will ever clear them, so that reason will keep getting renewed against an action that cannot work.

The remaining 18 exceptions are now unused (the scan lists them as cleanup candidates). Worth deleting in this PR so nobody renews them blindly.

Minor: go.work:5 still reads "revisited for go 1.25.x". And I would decline Copilot's pkg/fips/go.mod suggestion — the 155 modules left at go 1.25.0 are correct; only the 36 whose dependency graph forced it should have moved.

[LouisParkin]

All four issues addressed: Python CVE exceptions deleted, GO-2026-5932 purls updated to v0.55.0, go.work comment replaced with the permanent reason, and the gdb Dockerfile now verifies checksums with automation in update_go.py to keep them current.