Repository navigation
fix(release): build release binaries with Go 1.26.8 - #5
Merged
Merged
Conversation
The registry binary in goharbor-registry-photon:2.14.3-gac61290 reports ten Go stdlib CVEs, all with fixes available, because the release workflow pins Go 1.26.4: HIGH CVE-2026-33818 CVE-2026-39821 CVE-2026-39822 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 MEDIUM CVE-2026-42505 Every one of them is fixed in Go 1.26.6 or earlier (CVE-2026-46600 needs 1.26.6, the rest 1.26.5). Go 1.26.8 is the current patch release, so build with that. This surfaced when harbor-helm restored its trivy gate to exitCode 1: the scan of the registry image now fails the build instead of logging quietly. Bumping the dependency graph was not enough - the toolchain that compiles the released binary carries stdlib CVEs of its own. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
registrybinary shipped ingoharbor-registry-photon:2.14.3-gac61290reports ten Go stdlib CVEs, all with fixes available, becausereusable-release-alauda.yamlpins Go 1.26.4:Go 1.26.8 is the current patch release, so this pins that.
How it surfaced
harbor-helm just restored its per-image trivy gate to
exitCode 1(it had been advisory since 2026-07-16 while the photon base image was unpatched). With the gate live,build-registry-scanfails the build instead of logging quietly, and this is the first thing it caught. Notably it is real debt, not a no-fix advisory: bumping the dependency graph in #4 was not enough, because the toolchain that compiles the released binary carries stdlib CVEs of its own.After merge
A new
v2.8.4-alauda-*release needs to be cut, thenREGISTRY_VERSIONin harbor-helm.tekton/all-in-one.yamlbumped to it.Opened from a fork - my account has
pullon this repo, and both AlaudaDevops distribution repos share one fork network.🤖 Generated with Claude Code