[Aikido] Fix 79 security issues in gotenberg-fulll

[aikido-autofix]

Aikido updated the base image from debian:13-slim to debian:13-slim

The debian:13-slim base image digest was pinned to the latest digest and the build cache was refreshed, resolving 10 high-severity and 34 medium-severity vulnerabilities in chromium, stdlib, and various OS-level packages.

✅ 34 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-76036	HIGH	Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-76035	HIGH	Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-39821	HIGH	The idna package incorrectly accepts Punycode-encoded labels that decode to ASCII-only values, allowing attackers to bypass hostname validation checks and potentially escalate privileges by using encoded domain names that pass security filters.
CVE-2026-76040	HIGH	Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76034	HIGH	Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-76038	HIGH	Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76043	HIGH	Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76047	HIGH	Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76045	HIGH	Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-56865	MEDIUM	A malicious GOPROXY can forge sumdb tiles to bypass GOSUMDB verification and inject attacker-controlled module content into the local Go module cache, enabling undetected malicious module distribution. This vulnerability allows remote code execution through compromised module dependencies.
CVE-2026-76037	MEDIUM	Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
CVE-2026-76046	MEDIUM	Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76044	MEDIUM	Race condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-46600	MEDIUM	Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
CVE-2026-33818	MEDIUM	Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
CVE-2026-56853	MEDIUM	When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
CVE-2026-56859	MEDIUM	Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
CVE-2026-56862	MEDIUM	Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
CVE-2026-46603	MEDIUM	VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.
CVE-2026-56864	MEDIUM	A malicious GOSUMDB can serve arbitrary module content outside the transparency log, allowing coordinated GOPROXY and GOSUMDB servers to deliver undetectable malicious code to clients. This enables remote code execution through compromised Go module dependencies.
CVE-2026-76039	MEDIUM	Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
CVE-2026-72522	MEDIUM	libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
CVE-2025-14104	MEDIUM	A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam() function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
CVE-2026-56858	MEDIUM	Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
CVE-2026-56860	MEDIUM	A path resolution vulnerability with quadratic time complexity allowed attackers to cause denial of service through relative paths with parent directory segments. The fix implements efficient index-based backtracking to eliminate performance degradation.
CVE-2026-13595	LOW	A heap use-after-free vulnerability in libblkid's partition probing can be triggered by a crafted block device image, potentially leading to information disclosure or denial of service when automatically invoked by udev/udisks on device hot-plug events.
CVE-2026-27456	LOW	A TOCTOU race condition in util-linux's mount SUID binary allows local attackers to replace source files with symlinks to read arbitrary root-owned files and devices. This enables unauthorized access to sensitive data like backup images and disk volumes.
CVE-2026-76041	LOW	Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76033	LOW	Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVE-2026-76042	LOW	Use of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-53612	LOW
CVE-2026-53613	LOW
CVE-2026-53614	LOW
CVE-2026-53615	LOW