[tembleking]

Summary

Updates the base image and Go dependencies to fix known vulnerabilities in the published image, and bumps the version to 3.0.6.

Vulnerabilities fixed

• CVE-2026-114406 (CRITICAL): ca-certificates, distrust of eMudhra intermediate CA
• CVE-2026-111943 (HIGH): Go stdlib crypto/x509, MITM via untrusted intermediate certificates (fixed in Go 1.27.3)
• CVE-2026-34743 (xz-libs): denial of service via buffer overflow in index decoding
• CVE-2026-8932 (libcurl): security feature bypass due to improper handling

Remaining findings

The scan of the rebuilt image still reports 212 vulnerabilities, but none has a fixed version available upstream yet. They are mostly in openssl, rpm, sqlite, systemd and glibc, with status affected or will_not_fix.

Changes

• package.nix: version 3.0.5 → 3.0.6, updated vendorHash
• docker-base-{amd64,aarch64}.nix: base image update
• go.mod / go.sum, flake.lock: dependency updates
• internal/infra/sysdig/client.gen.go, internal/infra/sysdig/mocks/client_extension.go: regenerated client and mocks
• .github/workflows/*: CI workflow updates

Testing

• just check (fmt, lint, tests) passes locally.

Release

Merging to main makes publish.yaml create the v3.0.6 release.

[Copilot]

🔵 Needs a closer look

Unavailable image artifacts and scan reports prevent verification of the opaque base-image and Go-overlay pins, security scans for both architectures, and an embedded Go version of at least 1.27.3.

No open issues 🎉

1 file not reviewed

• internal/infra/sysdig/mocks/client_extension.go: Generated file

What changed in this PR

Prepares Sysdig MCP Server 3.0.6 with base-image and dependency updates intended to remediate vulnerabilities in the published container image.

Changes:

• Refreshes both architecture-specific base images, Go dependencies, and Nix inputs.
• Regenerates the Sysdig API client and mocks, adding v2alpha1 event API support.
• Updates CI action pins and release packaging metadata.

File	Description
package.nix	Bumps version to 3.0.6 and updates the vendor hash.
internal/​infra/​sysdig/​mocks/​client_extension.go	Adds mocks for the generated v2alpha1 event methods.
internal/​infra/​sysdig/​client.gen.go	Regenerates client models and methods, including v2alpha1 event APIs.
go.sum	Refreshes checksums for updated Go dependencies.
go.mod	Updates direct and indirect Go dependencies.
flake.lock	Refreshes Go overlay and nixpkgs pins.
docker-base-amd64.nix	Updates the AMD64 base-image digest and hash.
docker-base-aarch64.nix	Updates the ARM64 base-image digest and hash.
.github/​workflows/​pull-request-ci.yaml	Updates image-scanning and registry-login action pins.
.github/​workflows/​publish.yaml	Updates registry-login action pins for publishing.

_{Review effort: Balanced}