Build and scan with Go 1.26.10

govulncheck started failing CI on GO-2026-6809, a crypto/x509 flaw in the
standard library that is fixed in 1.26.10 and reachable through
http.Server.ListenAndServe. golang:1.26.9 is what ci.yaml, release.yaml and
the Dockerfile build with, so all five pins move together: the scan and the
shipped binary must agree on the toolchain, as in 3173abf.

No code change; go.mod still says go 1.25.9.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

.gitea/workflows/ci.yaml

@@ -35,7 +35,7 @@ jobs:
       # Runs inside the toolchain image rather than installing Go per job. Note this puts
       # the job on the dind bridge, which cannot reach github.com or get.helm.sh --
       # proxy.golang.org and git.ryuvia.com are reachable, which is all this job needs.
-      image: golang:1.26.9-bookworm
+      image: golang:1.26.10-bookworm
       # act_runner destroys a job's own volumes when it finishes, so without these every
       # run re-downloads the whole module graph. The names must appear in the runner's
       # container.valid_volumes allowlist (charts/act-runner in the k8s repo); unlisted
@@ -101,7 +101,7 @@ jobs:
   security:
     runs-on: ubuntu-latest
     container:
-      image: golang:1.26.9-bookworm
+      image: golang:1.26.10-bookworm
       volumes:
         - go-mod-cache:/go/pkg/mod
         - go-build-cache:/root/.cache/go-build

.gitea/workflows/release.yaml

@@ -30,7 +30,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     container:
-      image: golang:1.26.9-bookworm
+      image: golang:1.26.10-bookworm
       volumes:
         - go-mod-cache:/go/pkg/mod
         - go-build-cache:/root/.cache/go-build
@@ -71,7 +71,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     container:
-      image: golang:1.26.9-bookworm
+      image: golang:1.26.10-bookworm
       volumes:
         - go-mod-cache:/go/pkg/mod
         - go-build-cache:/root/.cache/go-build

Dockerfile

@@ -4,7 +4,7 @@
 # in per platform. The CI runner has no binfmt registration and no way to get one (the
 # JS action that used to install it cannot run there), so this is not just an
 # optimisation -- it is what makes the arm64 image buildable at all.
-FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine AS builder
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download

charts/terdut-server/Chart.yaml

@@ -15,5 +15,5 @@ type: application
 # appVersion and image.tag in values.yaml no longer agree, and that is not an oversight:
 # image.tag stays "latest", which is what a local install actually pulls. appVersion is
 # metadata and drives nothing.
-version: 0.47.1
+version: 0.48.0
-appVersion: "v0.47.1"
+appVersion: "v0.48.0"

internal/api/service_accounts_test.go

@@ -490,3 +490,31 @@ func TestDeadman_UpdateInPlacePreservesID(t *testing.T) {
 		t.Errorf("expected the update to replace in place, not add a row, got %d switches", len(list))
 	}
 }
+
+// The operator reconciles a team's dead man's switches by listing them, and its
+// instance-scoped account is not a member of any team it manages.
+func TestServiceAccount_InstanceScopeListsATeamsDeadmanSwitches(t *testing.T) {
+	s := newTS(t)
+	instanceKey := createServiceAccount(t, s, s.key, "terdut-operator", models.ServiceAccountScopeInstance, 0)
+	team := createTeamAs(t, s, instanceKey, "team-a")
+	path := "/api/teams/" + id64(team) + "/deadman/switches"
+
+	resp := s.reqAs(t, instanceKey, http.MethodPost, path,
+		map[string]any{"name": "watchdog", "matcher": "alertname=Watchdog", "timeout_seconds": 900, "severity": "critical"})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create switch: %d", resp.StatusCode)
+	}
+	resp.Body.Close()
+
+	resp = s.reqAs(t, instanceKey, http.MethodGet, path, nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("list switches as the instance account: %d", resp.StatusCode)
+	}
+	var list []struct {
+		Name string `json:"name"`
+	}
+	decode(t, resp, &list)
+	if len(list) != 1 || list[0].Name != "watchdog" {
+		t.Errorf("expected the one switch just created, got %+v", list)
+	}
+}

internal/api/teams.go

@@ -826,7 +826,10 @@ func handleListTeamDeadman(db *sql.DB) http.HandlerFunc {
 		if !ok {
 			return
 		}
-		if !requireTeamMember(w, r, teamID) {
+		// The operator's instance-scoped account reconciles the switches by name,
+		// so it has to read them without being a member: that is owner reach,
+		// the same as the writes below, and still reads no incidents.
+		if !isInstanceServiceAccount(r.Context()) && !requireTeamMember(w, r, teamID) {
 			return
 		}
 

internal/web/static/app.css

@@ -7,6 +7,7 @@
 
 :root {
   --bg: #f5f6f8;
+  --dot: rgba(60, 70, 95, 0.16);
   --surface: #ffffff;
   --surface-2: #eff1f4;
   --surface-hover: #f7f8fa;
@@ -79,6 +80,7 @@
 @media (prefers-color-scheme: dark) {
   :root:not([data-theme="light"]) {
     --bg: #0f1115;
+    --dot: rgba(148, 156, 180, 0.26);
     --surface: #1a1e26;
     --surface-2: #232834;
     --surface-hover: #20252e;
@@ -114,6 +116,7 @@
 }
 :root[data-theme="dark"] {
   --bg: #0f1115;
+  --dot: rgba(148, 156, 180, 0.26);
   --surface: #1a1e26;
   --surface-2: #232834;
   --surface-hover: #20252e;
@@ -163,6 +166,17 @@ body {
   -webkit-tap-highlight-color: transparent;
 }
 
+/* Dot grid behind everything, fading out down the screen. z-index -1 sits above
+   the canvas background but below all in-flow content, so no wrapper element
+   is needed. */
+body::before {
+  content: ""; position: fixed; inset: 0; z-index: -1; pointer-events: none;
+  background-image: radial-gradient(circle, var(--dot) 1.25px, transparent 1.75px);
+  background-size: 28px 28px;
+  -webkit-mask-image: linear-gradient(to bottom, #000 0%, #000 25%, transparent 88%);
+  mask-image: linear-gradient(to bottom, #000 0%, #000 25%, transparent 88%);
+}
+
 a { color: inherit; text-decoration: none; }
 button, input, textarea, select { font: inherit; color: inherit; }
 code { font-family: var(--mono); font-size: 0.9em; }