govulncheck reports reachable x/net HTTP/2 vulnerabilities
GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and
GO-2026-6603, all fixed in golang.org/x/net v0.60.0.
x/net v0.60.0 requires go 1.26, so the go directive moves to 1.26.0.
x/net v0.60.0 deprecates http2.ConfigureTransports and the
http2.Transport ReadIdleTimeout/PingTimeout fields (staticcheck
SA1019). Configure the same DoH HTTP/2 health check through
http.Transport.HTTP2: SendPingTimeout 10s and PingTimeout 5s. Add a
test that silences an HTTP/2 peer and requires the transport to close
the connection.
Using the same approach as in cd mode, but do it only once when running
ctrld the first time, then the config will be re-used then.
While at it, also adding Dockerfile.debug for better troubleshooting
with alpine base image.
Dev Scribe