[CP 1656] fix(security): weekly CVE remediation 2026-08-20

[ci-penbot-01]

cp of pensando/gpu-operator#1656

---

Source PR Description (pensando/gpu-operator#1656):

Summary

Weekly automated CVE remediation by cve-bot.

Baseline scan: 17 HIGH/CRITICAL CVEs
After fixes: 8 HIGH/CRITICAL CVEs
Fixed: 9 CVEs

What changed

 Dockerfile                                                     |  2 +-
 Dockerfile.build                                               |  6 +++---
 Makefile                                                       |  4 ++--
 dev.env                                                        |  4 ++--
 go.mod                                                         |  6 +++---
 go.sum                                                         |  8 ++++----
 .../v4/pkg/apis/workflow/v1alpha1/cron_workflow_types.go       |  2 +-
 .../v4/pkg/apis/workflow/v1alpha1/generated.proto              | 10 +++++-----
 .../v4/pkg/apis/workflow/v1alpha1/openapi_generated.go         | 10 +++++-----
 .../v4/pkg/apis/workflow/v1alpha1/workflow_types.go            |  8 ++++----
 vendor/modules.txt                                             |  6 +++---
 11 files changed, 33 insertions(+), 33 deletions(-)

Unfixable CVEs

• CVE-2026-33818 stdlib
• CVE-2026-39821 stdlib
• CVE-2026-46600 stdlib
• CVE-2026-56853 stdlib
• CVE-2026-56858 stdlib
• CVE-2026-56859 stdlib
• CVE-2026-56860 stdlib
• CVE-2026-56862 stdlib

Notes

• Automated by cve-bot
• Review required before merge

Cherrypick triggered by: ACP-Automation

[ci-penbot-01]

AI-Assisted Cherry-Pick

Source PR: #1656
Target Branch: main

The cherry-pick operation encountered merge conflicts which were resolved automatically using AI assistance.

Files with conflicts (resolved by AI):

• Makefile:131-136
• dev.env:N/A

Original conflict in Makefile

<<<<<<< HEAD
DOCKER_BUILDER_TAG := v1.7
=======
# Sourced from dev.env (single source of truth); fallback here if dev.env absent.
DOCKER_BUILDER_TAG ?= v1.8
>>>>>>> 58f4ec0c... fix(security): weekly CVE remediation 2026-08-20 (#1656)

Original conflict in dev.env

File was deleted in HEAD but exists in incoming commit (restored)

Cherry-pick triggered by: ACP-Automation

[spraveenio]

LGTM