chore(core): cve mitigation 08-06-2026 for release 1.9

.github/workflows/dev_module_build-and-registration.yml

@@ -26,7 +26,7 @@ env:
   MODULES_MODULE_TAG: ${{ github.event.inputs.tag }}
   SOURCE_REPO: "${{secrets.SOURCE_REPO}}"
   DECKHOUSE_PRIVATE_REPO: "${{secrets.DECKHOUSE_PRIVATE_REPO}}"
-  GO_VERSION: "1.25.10"
+  GO_VERSION: "1.25.11"
   MODULE_EDITION: "EE"
 
 on:

.github/workflows/dev_module_build.yml

@@ -24,7 +24,7 @@ env:
   MODULES_REGISTRY_PASSWORD: ${{ secrets.DEV_MODULES_REGISTRY_PASSWORD }}
   SOURCE_REPO: "${{secrets.SOURCE_REPO}}"
   DECKHOUSE_PRIVATE_REPO: "${{secrets.DECKHOUSE_PRIVATE_REPO}}"
-  GO_VERSION: "1.25.10"
+  GO_VERSION: "1.25.11"
   GOLANGCI_LINT_VERSION: "2.11.1"
   TRIVY_DISABLE_VEX_NOTICE: "true"
 

.github/workflows/dev_validation.yaml

@@ -15,7 +15,7 @@
 name: Validations
 
 env:
-  GO_VERSION: "1.25.10"
+  GO_VERSION: "1.25.11"
 on:
   pull_request:
     types: [opened, synchronize, labeled, unlabeled]
@@ -137,9 +137,9 @@ jobs:
       matrix:
         # Define two groups of components with their respective Go versions
         components:
-          - { component: virtualization-artifact, go-version: "1.25.10" }
-          - { component: vm-route-forge, go-version: "1.25.10" }
-          - { component: api, go-version: "1.25.10" }
+          - { component: virtualization-artifact, go-version: "1.25.11" }
+          - { component: vm-route-forge, go-version: "1.25.11" }
+          - { component: api, go-version: "1.25.11" }
 
     steps:
       - name: Set skip flag

.github/workflows/e2e-matrix.yml

@@ -427,7 +427,7 @@ jobs:
       virtualization_tag: main
       deckhouse_channel: alpha
       default_user: cloud
-      go_version: "1.25.10"
+      go_version: "1.25.11"
       e2e_timeout: "3.5h"
       date_start: ${{ needs.set-vars.outputs.date_start }}
       randuuid4c: ${{ needs.set-vars.outputs.randuuid4c }}

.github/workflows/e2e-test-releases-reusable-pipeline.yml

@@ -84,7 +84,7 @@ on:
       go_version:
         required: false
         type: string
-        default: "1.25.10"
+        default: "1.25.11"
         description: "Go version"
       apt_mirror_enabled:
         required: false

.github/workflows/release_module_release-channels.yml

@@ -123,7 +123,7 @@ jobs:
     needs: print-vars
     if: ${{ !inputs.check_only && (inputs.ce || inputs.ee) }}
     env:
-      GO_VERSION: "1.25.10"
+      GO_VERSION: "1.25.11"
       input_channel: ${{ github.event.inputs.channel }}
       input_version: ${{ github.event.inputs.tag }}
     steps:
@@ -417,7 +417,7 @@ jobs:
     name: Check version on release channel
     runs-on: ubuntu-latest
     env:
-      GO_VERSION: "1.25.10"
+      GO_VERSION: "1.25.11"
       input_channel: ${{ github.event.inputs.channel }}
       input_version: ${{ github.event.inputs.tag }}
     needs:

.werf/defines/parse-base-images-map.tmpl

@@ -16,19 +16,44 @@
 
 {{- define "parse_base_images_map" }}
 {{-   $deckhouseImages := .Files.Get "build/base-images/deckhouse_images.yml" | fromYaml }}
+{{-   $containerFactoryImages := .Files.Get "build/base-images/container_factory_images.yml" | fromYaml }}
 {{/*
   # deckhouse_images has a format
   # <prefix>/<name>: "sha256:abcde12345
 */}}
 {{-   $usedImagesDict := (include "project_images" . | fromJson) }}
 {{-   range $k, $v := $deckhouseImages }}
-{{-     $baseImagePath := (printf "%s@%s" $deckhouseImages.REGISTRY_PATH (trimSuffix "/" $v)) }}
 {{-     if ne $k "REGISTRY_PATH" }}
+{{-       $baseImagePath := (printf "%s@%s" $deckhouseImages.REGISTRY_PATH (trimSuffix "/" $v)) }}
 {{-       $_ := set $deckhouseImages $k $baseImagePath }}
 {{-     end }}
 {{-   end }}
 {{-   $_ := unset $deckhouseImages "REGISTRY_PATH" }}
-{{-   $_ := set . "Images" (mustMerge $deckhouseImages) }}
+{{-   if $containerFactoryImages }}
+{{-     range $k, $v := $containerFactoryImages }}
+{{-       if ne $k "REGISTRY_PATH" }}
+{{-         $baseImagePath := (printf "%s@%s" $containerFactoryImages.REGISTRY_PATH (trimSuffix "/" $v)) }}
+{{-         $_ := set $containerFactoryImages $k $baseImagePath }}
+{{-       end }}
+{{-     end }}
+{{-     $_ := unset $containerFactoryImages "REGISTRY_PATH" }}
+{{/*
+  # Source pins: image names that must be taken from container_factory_images
+  # instead of the default deckhouse_images source. Declared in a module-owned
+  # data file so the image libraries in build/base-images stay untouched.
+*/}}
+{{-     $pins := .Files.Get "build/base-images/base-images-pins.yml" | fromYaml }}
+{{-     $containerFactoryOverrideImages := $pins.fromContainerFactory | default list }}
+{{-     $containerFactoryOverrides := dict }}
+{{-     range $k := $containerFactoryOverrideImages }}
+{{-       if hasKey $containerFactoryImages $k }}
+{{-         $_ := set $containerFactoryOverrides $k (get $containerFactoryImages $k) }}
+{{-       end }}
+{{-     end }}
+{{-     $_ := set . "Images" (mustMerge $containerFactoryOverrides $deckhouseImages $containerFactoryImages) }}
+{{-   else }}
+{{-     $_ := set . "Images" (mustMerge $deckhouseImages) }}
+{{-   end }}
 {{/* # base images artifacts */}}
 {{-   range $k, $v := .Images }}
 {{-     if hasKey $usedImagesDict $k }}

api/client/examples/cancel-evacuation/go.mod

@@ -1,6 +1,6 @@
 module github.com/deckhouse/virtualization/api/client/examples/cancel-evacuation
 
-go 1.25.10
+go 1.25.11
 
 require (
 	github.com/deckhouse/virtualization/api v1.6.1

api/client/examples/list-resources/go.mod

@@ -1,6 +1,6 @@
 module github.com/deckhouse/virtualization/api/client/examples/list-resources
 
-go 1.25.10
+go 1.25.11
 
 require (
 	github.com/deckhouse/virtualization/api v1.6.1

api/client/examples/resourceclaim/go.mod

@@ -1,6 +1,6 @@
 module github.com/deckhouse/virtualization/api/client/examples/resourceclaim
 
-go 1.25.10
+go 1.25.11
 
 require (
 	github.com/deckhouse/virtualization/api v1.6.1

api/go.mod

@@ -1,6 +1,6 @@
 module github.com/deckhouse/virtualization/api
 
-go 1.25.10
+go 1.25.11
 
 tool (
 	k8s.io/code-generator

build/base-images/base-images-pins.yml

@@ -0,0 +1,12 @@
+# Base image source pins (module-owned configuration).
+#
+# deckhouse_images.yml and container_factory_images.yml in this directory are
+# treated as read-only image libraries. When the same image name exists in both,
+# the default merge precedence prefers deckhouse_images. List here the image
+# names that must instead be taken from container_factory_images, with a reason.
+#
+# Consumed by .werf/defines/parse-base-images-map.tmpl.
+fromContainerFactory:
+  # CVE mitigation (08-06-2026): requires the ALT 20260119 based toolchain
+  # provided by container-factory instead of the deckhouse_images build.
+  - builder/golang-alt-1.25