fix(runtime-image): rebuild vault with klauspost/compress v1.18.7 and Go 1.26.10 (patched.16)

Dockerfile.runtime

@@ -3,7 +3,7 @@
 ARG VAULT_COMMIT=7193f9a48ff6093ca61b3b627a8671e770428ba6
 ARG VAULT_VERSION=2.0.3
 
-FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine3.24@sha256:cdfd4fe2da6b225d8b40c6b7a105736e548e83ff56d5d8f9394446eeb5eb84e0 AS source
+FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS source
 ARG VAULT_COMMIT
 ARG VAULT_VERSION
 RUN apk add --no-cache git \
@@ -21,19 +21,20 @@ RUN corepack enable \
     && pnpm rebuild node-sass \
     && pnpm run build
 
-FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine3.24@sha256:cdfd4fe2da6b225d8b40c6b7a105736e548e83ff56d5d8f9394446eeb5eb84e0 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS builder
 ARG VAULT_COMMIT
 ARG VAULT_VERSION
 RUN apk add --no-cache bash git
 COPY --from=ui /src /src
 WORKDIR /src
 RUN --mount=type=cache,target=/go/pkg/mod \
-    go get google.golang.org/grpc@v1.83.2 github.com/apache/thrift@v0.24.0 golang.org/x/crypto@v0.57.0 golang.org/x/text@v0.42.0 golang.org/x/net@v0.60.0 \
+    go get google.golang.org/grpc@v1.83.2 github.com/apache/thrift@v0.24.0 golang.org/x/crypto@v0.57.0 golang.org/x/text@v0.42.0 golang.org/x/net@v0.60.0 github.com/klauspost/compress@v1.18.7 \
     && go mod download \
     && test "$(go list -m -f '{{.Version}}' google.golang.org/grpc)" = "v1.83.2" \
     && test "$(go list -m -f '{{.Version}}' github.com/apache/thrift)" = "v0.24.0" \
     && test "$(go list -m -f '{{.Version}}' golang.org/x/crypto)" = "v0.57.0" \
     && test "$(go list -m -f '{{.Version}}' golang.org/x/text)" = "v0.42.0" \
+    && test "$(go list -m -f '{{.Version}}' github.com/klauspost/compress)" = "v1.18.7" \
     && test "$(go list -m -f '{{.Version}}' golang.org/x/net)" = "v0.60.0"
 ARG TARGETARCH
 ARG TARGETOS
@@ -44,7 +45,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
        go build -buildvcs=false -tags "vault ui" \
        -ldflags "-X github.com/hashicorp/vault/version.GitCommit=${VAULT_COMMIT}+codefly.2 -X github.com/hashicorp/vault/version.BuildDate=${build_date} -X github.com/hashicorp/vault/version.Version=${VAULT_VERSION}" \
        -o bin/vault .
-RUN go version -m bin/vault | grep -F "go1.26.9" \
+RUN go version -m bin/vault | grep -F "go1.26.10" \
     && go version -m bin/vault | grep -F "google.golang.org/grpc" | grep -F "v1.83.2" \
     && go version -m bin/vault | grep -F "github.com/apache/thrift" | grep -F "v0.24.0" \
     && go version -m bin/vault | grep -F "golang.org/x/crypto" | grep -F "v0.57.0" \

main.go

@@ -50,8 +50,8 @@ type Settings struct {
 
 var image = &resources.DockerImage{
 	Name:   "ghcr.io/codefly-dev/service-vault-runtime",
-	Tag:    "runtime-v2.0.3-patched.13",
-	Digest: "sha256:86aa9162af5494eb7bdd1173773037bb7b4dc3632bdf316b27eb345ca2d47355",
+	Tag:    "runtime-v2.0.3-patched.16",
+	Digest: "sha256:418b04bcfd26211ca40580c8a670cbe55f21e07a81b221f44eded37e8e7b8aa4",
 }
 
 type Service struct {

main_test.go

@@ -99,9 +99,10 @@ func TestVaultImageSBOM(t *testing.T) {
 	// Verify the actual binary inventory contains the fixes, even if a scanner
 	// database later drops an advisory or stops recognizing a Go dependency.
 	for module, version := range map[string]string{
-		"github.com/apache/thrift": "v0.24.0",
-		"golang.org/x/net":         "v0.60.0",
-		"google.golang.org/grpc":   "v1.83.2",
+		"github.com/apache/thrift":      "v0.24.0",
+		"github.com/klauspost/compress": "v1.18.7",
+		"golang.org/x/net":              "v0.60.0",
+		"google.golang.org/grpc":        "v1.83.2",
 	} {
 		found := false
 		for _, component := range response.GetBom().GetComponents() {