fix: remediate git-server image vulnerabilities for Plural Service: mgmt/console

[plural-copilot]

Summary

This PR remediates the reported ghcr.io/pluralsh/git-server source-repo vulnerabilities for Plural Service: mgmt/console with the smallest coherent source change.

What changed

• Updated the runtime image base in Dockerfile from alpine:edge to alpine:3.23.
• Kept the existing apk add --no-cache git bash openssh curl libcurl package install flow.
• Confirmed the repo already pins Go to 1.26.5 in go.mod.
• Confirmed CI already inherits that version through actions/setup-go with go-version-file: go.mod.
• Confirmed the module graph already resolves:
  • golang.org/x/net v0.56.0
  • golang.org/x/text v0.39.0

Why

• The Go stdlib CVEs are already addressed in this repo because the toolchain is already pinned to Go 1.26.5.
• The Go module CVEs are already addressed because the resolved dependency versions already meet the requested fixed minimums.
• The remaining required remediation was ensuring the built image installs fixed curl/libcurl packages; with the alpine:3.23 base, the build resolves curl and libcurl to 8.20.0-r0.

Verification

• Built the Docker image locally with Docker.
• Verified apk policy curl libcurl in the built image reports 8.20.0-r0 for both packages.

Related dependency updates

• None were needed in go.mod/go.sum; the requested fixed Go and module versions were already present, so no related dependency churn was introduced.

libcurl remediation source

• The libcurl fix came from a base image bump only; the package install line remained unchanged.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create a source-repo remediation PR for ghcr.io/pluralsh/git-server vulnerabilities for Plural Service: mgmt/console....
🔗 Run history	View run history