Repository navigation
🔒 fix(deps): bump Go toolchain to 1.26.10 (GO-2026-6809) - #227
Merged
Merged
Conversation
GO-2026-6809 is a crypto/x509 vulnerability in the standard library, fixed in go1.26.10. Scheduled Vulncheck on main has been red since 2026-10-26, which also fails vulncheck and test on every open PR. Bumps go.mod, the Dockerfile builder (tag and digest), the devcontainer image and the pinned version in docs/LOCAL_SETUP.md. govulncheck ./... reports no affected vulnerabilities on 1.26.10.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Sonar docker:S8431 rejects an image reference that carries both a tag and a digest. Drop the tag from the golang and distroless FROM lines and keep the version as a comment. The digest is still required. Gate change, justified: hack/test/sonar_mk_11_dockerfile_digest_test.sh matched the "golang:" and "gcr.io/distroless/static:" prefixes, so it now matches the image name alone. It still fails unless the FROM line carries @sha256:<64 hex>, so the digest-pin requirement (REQ-SEC-2026-08) is unchanged; only the tag requirement is dropped.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the red scheduled Vulncheck on main (GO-2026-6809, crypto/x509, fixed in go1.26.10), which also fails vulncheck and test on the open dependency PRs.
Changes: go.mod, Dockerfile builder tag and digest, devcontainer image, docs/LOCAL_SETUP.md.
Verification:
GOTOOLCHAIN=go1.26.10 govulncheck ./...reports no affected vulnerabilities.