Fix CVE-2025-61726: Upgrade Go to 1.24.12

[chainloop-platform]

Summary

Upgraded the Go version from 1.21 to 1.24.12 to remediate CVE-2025-61726, a HIGH severity vulnerability that allows unbounded memory consumption through excessive query parameters.

Vulnerability Fixed

CVE-2025-61726 (HIGH severity): The net/url package in Go versions prior to 1.24.12 and 1.25.6 does not limit the number of query parameters when parsing URL-encoded forms. This allows attackers to cause excessive memory consumption by sending HTTP requests with thousands of unique query parameters, leading to denial-of-service.

Changes Made

• Upgraded Go version in go.mod from 1.21 to 1.24.12
• This version includes the fix that limits the number of query parameters during form parsing
• The vulnerable code paths at simple-todo.go:78 and simple-todo.go:94 (POST /todos and PUT /todos/:id endpoints) are now protected by the patched net/url implementation