chore(docker): refresh bundled proxy toolchain image

.grype.yaml

@@ -4,6 +4,25 @@
 # Documentation: https://github.com/anchore/grype#specifying-matches-to-ignore
 
 ignore:
+
+  # - CVE-2026-116585:
+  - vulnerability: GHSA-4w3g-jfj2-cw2q
+    package:
+      name: github.com/go-jose/go-jose/v3
+      type: go-module
+    reason: |
+      HIGH — Panic during CBC-HMAC processing
+    expiry: "2026-11-29"
+
+  # - CVE-2026-116586:
+  - vulnerability: GHSA-6mp9-8xrw-74r4
+    package:
+      name: github.com/go-jose/go-jose/v3
+      type: go-module
+    reason: |
+      HIGH — Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.
+    expiry: "2026-11-29"
+
   # GHSA-mgcc-cww5-fp2q / CVE-2026-116587: Go JOSE: DoS when parsing JWKs that contain RSA keys
   # Severity: HIGH
   # Package: github.com/go-jose/go-jose/v3 v3.0.5 (embedded in /usr/bin/caddy)
@@ -1441,6 +1460,15 @@ ignore:
       Alpine/upstream patch.
     expiry: "2026-10-18"  # Review: Initial suppression 2026-09-18. Next review: 2026-10-18.
 
+     # References:
+  # - CVE-2026-116586:
+  - vulnerability: GHSA-6mp9-8xrw-74r4
+    package:
+      name: Go JOSE
+    reason: |
+      HIGH — Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.
+    expiry: "2026-11-23"  # Review: Initial suppression 2026-09-18. Next review: 2026-10-18.
+
     # Action items when this suppression expires:
     # 1. Check Alpine's zlib package tracker for a patched build past 1.3.2-r0
     # 2. If a patched package is available: rebuild Docker image, run security-scan-docker-image,

.trivyignore

@@ -327,4 +327,18 @@ CVE-2026-85091
 # No upstream fix or v3 patch available
 # Review by: 2026-11-28
 # exp: 2026-11-28
-CVE-2026-116587
+CVE-2026-116587
+
+# CVE-2026-116586: Go JOSE: Panics in JSON parsing 
+# Severity: HIGH
+# No upstream fix or v3 patch available
+# Review by: 2026-11-29
+# exp: 2026-11-29
+CVE-2026-116586
+
+# CVE-2026-116585: Go JOSE: Panics in JSON parsing 
+# Severity: HIGH
+# No upstream fix or v3 patch available
+# Review by: 2026-11-29
+# exp: 2026-11-29
+CVE-2026-116585

Dockerfile

@@ -19,8 +19,8 @@ ARG CHARON_TOOLCHAIN_IMAGE=ghcr.io/wikid82/charon-toolchain
 # NOT Renovate-tracked (a content-hash tag has no series to follow, N7) — the
 # toolchain-image.yml bot owns these two lines. DIGEST is the arch-independent
 # manifest-list (OCI index) digest, so one pin covers linux/amd64 + linux/arm64.
-ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-beabb9a1afb75f01
-ARG CHARON_TOOLCHAIN_DIGEST=sha256:0c5a9a27132bf11b25bdf5f300c89cf02fb9ccf396c5fdbc524d7bb8afefd9b6
+ARG CHARON_TOOLCHAIN_TAG=caddy-crowdsec-ca89f6a1428729c6
+ARG CHARON_TOOLCHAIN_DIGEST=sha256:f7c7a1ca44b61401fb95dd0ec44b5216f220e86581229be42117fb7de3005837
 
 # Stage selector — default consumes the prebuilt toolchain image (no compile).
 # Fork PRs / bootstrap / offline builds pass