Request: cut a 0.14.3 release for the golang.org/x/crypto CVEs already fixed on main

Problem Description

gha-runner-scale-set-controller:0.14.2 (the current latest chart/image, published 2026-05-22 — confirmed against the ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller OCI tag list, nothing newer exists) scans with 17 relevant critical/high CVEs in golang.org/x/crypto, all traced to the pinned v0.49.0:

CVE-2026-39827, -39828, -39829, -39830, -39831, -39832, -39833, -39834, -39835, -42508, -46595, -46597, -46598, -56854, -56855, -78662, and GO-2026-5932.

Every one of the four binaries in the image (manager, github-webhook-server, ghalistener, actions-metrics-server) is affected — they're all built against the same go.mod.

The fix is already merged

main's go.mod already pins golang.org/x/crypto v0.52.0, which clears all of the above. Comparing the two:

gha-runner-scale-set-0.14.2 go.mod:  golang.org/x/crypto v0.49.0 // indirect
main go.mod:                         golang.org/x/crypto v0.52.0 // indirect

No code change needed on our end to ask for — just a release cut from main.

Proposed Solution

A 0.14.3 (or similar) release from current main would clear all 17 findings above. It's been about 4 months since 0.14.2; given how active this repo is otherwise, wanted to flag this explicitly in case it's just not on anyone's radar yet rather than deliberately held back.

Additional Information

Happy to test a release candidate against our clusters if that's useful.

Start by comparing the release 0.14.2 go.mod with main's go.mod and confirming the golang.org/x/crypto version used by the four binaries. Review the repository's release process and existing OCI tags; done means a 0.14.3-or-later chart/image is published from main and the listed CVEs no longer appear.