From 94c394e8f102937413e3e4d271809586f53d85a6 Mon Sep 17 00:00:00 2001 From: Niklas Ye Date: Wed, 21 Oct 2026 21:55:04 +0200 Subject: [PATCH] Build and scan with Go 1.26.10 govulncheck started failing CI on GO-2026-6809, a crypto/x509 flaw in the standard library that is fixed in 1.26.10 and reachable through http.Server.ListenAndServe. golang:1.26.9 is what ci.yaml, release.yaml and the Dockerfile build with, so all five pins move together: the scan and the shipped binary must agree on the toolchain, as in 3173abf. No code change; go.mod still says go 1.25.9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN --- .gitea/workflows/ci.yaml | 4 ++-- .gitea/workflows/release.yaml | 4 ++-- Dockerfile | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 09cd03d..71c4779 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -35,7 +35,7 @@ jobs: # Runs inside the toolchain image rather than installing Go per job. Note this puts # the job on the dind bridge, which cannot reach github.com or get.helm.sh -- # proxy.golang.org and git.ryuvia.com are reachable, which is all this job needs. - image: golang:1.26.9-bookworm + image: golang:1.26.10-bookworm # act_runner destroys a job's own volumes when it finishes, so without these every # run re-downloads the whole module graph. The names must appear in the runner's # container.valid_volumes allowlist (charts/act-runner in the k8s repo); unlisted @@ -101,7 +101,7 @@ jobs: security: runs-on: ubuntu-latest container: - image: golang:1.26.9-bookworm + image: golang:1.26.10-bookworm volumes: - go-mod-cache:/go/pkg/mod - go-build-cache:/root/.cache/go-build diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml index c4ded87..e00847e 100644 --- a/.gitea/workflows/release.yaml +++ b/.gitea/workflows/release.yaml @@ -30,7 +30,7 @@ jobs: test: runs-on: ubuntu-latest container: - image: golang:1.26.9-bookworm + image: golang:1.26.10-bookworm volumes: - go-mod-cache:/go/pkg/mod - go-build-cache:/root/.cache/go-build @@ -71,7 +71,7 @@ jobs: needs: test runs-on: ubuntu-latest container: - image: golang:1.26.9-bookworm + image: golang:1.26.10-bookworm volumes: - go-mod-cache:/go/pkg/mod - go-build-cache:/root/.cache/go-build diff --git a/Dockerfile b/Dockerfile index 4f5623e..724ac0f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # in per platform. The CI runner has no binfmt registration and no way to get one (the # JS action that used to install it cannot run there), so this is not just an # optimisation -- it is what makes the arm64 image buildable at all. -FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine AS builder +FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine AS builder WORKDIR /src COPY go.mod go.sum ./ RUN go mod download