[chen21019]

Docker Machine in the bundle linked golang.org/x/net v0.60.0, affected by CVE-2026-78661 and CVE-2026-97045. Rebuild bundle 0.16.6 with official x/net v0.62.0 and the dependencies required by its module graph. The existing Go 1.27.3 toolchain, upstream source coordinates, transport/provider implementation and retired Packet policy are unchanged.

The two new zero-fuzz patches change only go.mod and go.sum; source, module, binary and license checks remain exact. The existing full gate and protected-main provenance workflow remain in force.

Validation:

• Initial hash qualification correctly failed the old checksum gate. The preserved official artifact bytes were independently reviewed, and the follow-up commit changes exactly three checksum locks. This run is not counted as a passing release gate.
• Complete branch gate passed upstream tests, core/provider race tests, protocol discovery, reproducibility, packaging, source/artifact scans, secret scan, SBOM generation and source-mode symbol reachability.
• CodeQL and its alert aggregator passed; PR open alerts are empty.

The raw product scan retains only the two exact GO-2026-5932 x/crypto v0.58.0 module findings. Neither binary imports OpenPGP or has a reachable package/function trace; the version-bound OpenVEX statement remains the only exception. The protected-main gate and attestation will run before publication.