[RemiBou]

Summary

Remediates critical CVEs reported on ecosystem-cli-docker-images-rb-v2 / 2.106.0 (JGC-496, JGC-498):

• JGC-496 — CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508 in golang.org/x/crypto (scanned at v0.45.0) → pinned v0.52.0 (fixed per GO-2026-5017)
• JGC-498 — CVE-2026-39821 in golang.org/x/net (scanned at v0.47.0) → pinned v0.55.0 (fixed per GO-2026-5026)

Also bumps github.com/sigstore/sigstore-go v1.1.4 → v1.2.0 (and related sigstore modules), removing a transitive dependency path that still declared vulnerable golang.org/x/crypto / golang.org/x/net versions in its module metadata.

Impacted service version: jfrog-cli release bundle 2.106.0 (latest line on master).

Test plan

• go vet ./...
• go test ./utils/... ./mcp/... ./general/...
• CI green on PR
• Re-scan RB after next CLI docker image release to confirm CVEs cleared

Made with Cursor

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}