[NPM] [Vulnerability] Resolve ghsa-fv92-fjc5-jj9h Vulnerability

[rayaisaiah]

Reason for Change:
Resolves ghsa-fv92-fjc5-jj9h Vulnerability present in the github.com/go-viper/mapstructure/v2 v2.2.1 package in the current v1.6.26 version.

Other CVEs resolved in #3763.

mcr.microsoft.com/containernetworking/azure-npm:v1.6.26 (ubuntu 24.04)

Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌────────────────────┬───────────────┬──────────┬────────┬───────────────────┬──────────────────┬───────────────────────────────────────────┐
│      Library       │ Vulnerability │ Severity │ Status │ Installed Version │  Fixed Version   │                   Title                   │
├────────────────────┼───────────────┼──────────┼────────┼───────────────────┼──────────────────┼───────────────────────────────────────────┤
│ libpam-modules     │ CVE-2025-6020 │ MEDIUM   │ fixed  │ 1.5.3-5ubuntu5.1  │ 1.5.3-5ubuntu5.4 │ linux-pam: Linux-pam directory Traversal  │
│                    │               │          │        │                   │                  │ https://avd.aquasec.com/nvd/cve-2025-6020 │
├────────────────────┤               │          │        │                   │                  │                                           │
│ libpam-modules-bin │               │          │        │                   │                  │                                           │
│                    │               │          │        │                   │                  │                                           │
├────────────────────┤               │          │        │                   │                  │                                           │
│ libpam-runtime     │               │          │        │                   │                  │                                           │
│                    │               │          │        │                   │                  │                                           │
├────────────────────┤               │          │        │                   │                  │                                           │
│ libpam0g           │               │          │        │                   │                  │                                           │
│                    │               │          │        │                   │                  │                                           │
└────────────────────┴───────────────┴──────────┴────────┴───────────────────┴──────────────────┴───────────────────────────────────────────┘

usr/bin/azure-npm (gobinary)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│               Library               │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                           │
├─────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ github.com/go-viper/mapstructure/v2 │ GHSA-fv92-fjc5-jj9h │ MEDIUM   │ fixed  │ v2.2.1            │ 2.3.0         │ mapstructure May Leak Sensitive Information in Logs When │
│                                     │                     │          │        │                   │               │ Processing Malformed Data                                │
│                                     │                     │          │        │                   │               │ https://github.com/advisories/GHSA-fv92-fjc5-jj9h        │
└─────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

acnpublic.azurecr.io/azure-npm:v1.6.27New2 (ubuntu 24.04)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:

[Copilot]

Pull Request Overview

This PR resolves the GHSA-fv92-fjc5-jj9h vulnerability by updating package versions and dependencies, as well as moving to a newer base image. Key changes include:

• Updating the base image in npm/linux.Dockerfile from Ubuntu 20.04 to 24.04 and pinning related package versions.
• Changing the IP_TAG value in hack/aks/Makefile.
• Bumping the version of github.com/go-viper/mapstructure/v2 in go.mod from v2.2.1 to v2.3.0.

Reviewed Changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
npm/linux.Dockerfile	Updated base image to Ubuntu 24.04 and installed pinned package versions for fixes
hack/aks/Makefile	Modified the IP_TAG value to match the appropriate non-production setting
go.mod	Upgraded github.com/go-viper/mapstructure/v2 to a fixed version for vulnerability resolution

[rayaisaiah]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).