go-restful dependency contains vulnerability

Checks

• I've already read https://github.com/actions/actions-runner-controller/blob/master/TROUBLESHOOTING.md and I'm sure my issue is not covered in the troubleshooting guide.
• I'm not using a custom entrypoint in my runner image

Controller Version

v0.27.0

Helm Chart Version

No response

CertManager Version

No response

Deployment Method

Helm

cert-manager installation

There is no issue with cert manager

Checks

• This isn't a question or user support case (For Q&A and community support, go to Discussions. It might also be a good idea to contract with any of contributors and maintainers if your business is so critical and therefore you need priority support
• I've read releasenotes before submitting this issue and I'm sure it's not due to any recently-introduced backward-incompatible changes
• My actions-runner-controller version (v0.x.y) does support the feature
• I've already upgraded ARC (including the CRDs, see charts/actions-runner-controller/docs/UPGRADING.md for details) to the latest and it didn't fix the issue
• I've migrated to the workflow job webhook event (if you using webhook driven scaling)

Resource Definitions

N/A

To Reproduce

We scanned summerwind/actions-runner-controller image with Prisma

Describe the bug

github.com/emicklei/go-restful/v3 module prior to v3.10.0 is vulnerable to Authentication Bypass by Primary Weakness. There is an inconsistency in how go-restful parses URL paths. This inconsistency could lead to several security check bypass in a complex system.

Describe the expected behavior

summerwind/actions-runner-controller doesn't contain vulnerable packages

Whole Controller Logs

N/A

Whole Runner Pod Logs

N/A

Additional Context

No response

Start by locating the Go dependency declaration for github.com/emicklei/go-restful/v3 and verify its version against the v3.10.0 fix cited in the issue. Rebuild or scan the controller image and run the repository's existing checks; done means the vulnerable dependency is no longer reported.