[BEE-1343] Security fix service binary in localstack docker desktop

[jbeemster]

Moves the builder from golang:1.25-alpine to golang:1.26-alpine. Go 1.25 is EOL and the floating tag is stuck at 1.25.14; the three flagged stdlib CVEs are only fixed in 1.26.9 / 1.27.2, so a rebuild alone no longer clears them. The tag stays floating on the 1.26 line so future stdlib CVEs keep self-healing on routine rebuilds.

CVE-2026-78667 net/http
CVE-2026-78669 net/http/internal/http2
CVE-2026-97031 crypto/tls

Bumps golang.org/x/net to v0.60.0, clearing CVE-2026-78669 in the module copy of http2. x/net@v0.60.0 requires go 1.26, which raises the go directive; x/crypto, x/sys and x/text move with it as MVS requirements.

Bumps TAG to 2026.10.0.

Verified with trivy: service gobinary goes from 5 HIGH to 1 HIGH. The remainder is CVE-2026-55677 against echo v3.3.10+incompatible, which has no fixed version for the v3 module path.

[jbeemster]

Report Summary

┌────────────────────────────────────────────────────────────────┬──────────┬─────────────────┐
│                             Target                             │   Type   │ Vulnerabilities │
├────────────────────────────────────────────────────────────────┼──────────┼─────────────────┤
│ localstack/localstack-docker-desktop:2026.10.0 (alpine 3.24.2) │  alpine  │        0        │
├────────────────────────────────────────────────────────────────┼──────────┼─────────────────┤
│ service                                                        │ gobinary │        1        │
└────────────────────────────────────────────────────────────────┴──────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


service (gobinary)

Total: 1 (HIGH: 1, CRITICAL: 0)

┌──────────────────────────┬────────────────┬──────────┬──────────┬──────────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │  Status  │  Installed Version   │ Fixed Version │                          Title                           │
├──────────────────────────┼────────────────┼──────────┼──────────┼──────────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ github.com/labstack/echo │ CVE-2026-55677 │ HIGH     │ affected │ v3.3.10+incompatible │               │ github.com/labstack/echo: Echo: Unauthorized Information │
│                          │                │          │          │                      │               │ Disclosure via URL Path Decoding Discrepancy             │
│                          │                │          │          │                      │               │ https://avd.aquasec.com/nvd/cve-2026-55677               │
└──────────────────────────┴────────────────┴──────────┴──────────┴──────────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

One unfixable HIGH leftover but otherwise clean.

[Pive01]

Just a quick thought on listing the exact CVE numbers...in general publishing specific vulnerability details can sometimes make it easier to target unpatched versions. Do you think we should generalize the wording here, or is there a reason we should specify them for this release?

[jbeemster]

I guess the thing is you can just run trivy (oss) against any version of the public images and yield the same list? I am not sure there is much more security in obfuscation here but providing direct links might prompt people on the other hand to update where "Security update" might no be a lot of information.

[Pive01]

True, also probably does not matter in this case as I cannot think of any harm you could do with just the extension....Just looks a bit odd to say to the world "yo you can exploit this with my image" haha instead of letting them figure it out on it's own....but I'm also happy to let it merge like so 👍