Repository navigation
Move the Go module to Go 1.26.9 and golang.org/x/net 0.60.0 (new Go advisories) #4684
Description
🤖 Generated by the Agentic Engineer
Problem
New Go advisories (GO-2026-6603 through GO-2026-6617) affect the Go 1.26.6 standard library and golang.org/x/net 0.58.0. This repository's Go module is on both (go 1.26.6, golang.org/x/net v0.58.0). The fixed releases are Go 1.26.9 and golang.org/x/net 0.60.0.
Nothing fails here today, because no check in this repository scans the Go module. The same advisories began failing the vulnerability scan in data-product-controller on 2026-10-09 (fixed in devantler-tech/data-product-controller#369, and in devantler-tech/provider-upjet-unifi#58). KSail is already on the fixed releases.
Acceptance criteria
go.modand every place that installs Go for this module are on Go 1.26.9 or later.golang.org/x/netis 0.60.0 or later.- A vulnerability scan of the module (for example
trivy fs --scanners vuln .) reports none of the advisories above.
Notes
The Go code here is deploy and CI tooling, so exposure is limited to those tools' own network use. The change has to pass the merge queue's production deploy, which is not accepting changes at the moment (#4673), so it should be queued once deploys are healthy.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Effort
Projects
- Status
Activity
devantler commentedon Oct 10, 2026
Refinement, 2026-10-10: the change is tried and small, and it was deliberately not opened
I claimed this, built and checked the change locally, and then stood down before pushing anything. The board has 26 issues in review against a limit of 12 and 9 in verification against a limit of 3, and this issue is still in Backlog, so starting it now would add to the pile rather than finish something. The claim is retired and the issue is unassigned again. Everything learned is below, so whoever pulls it next can open the pull request in a few minutes.
The change (root module only)
go get go@1.26.9 golang.org/x/net@v0.60.0 && go mod tidychanges two files:go.mod: Go 1.26.6 → 1.26.9,golang.org/x/net0.58.0 → 0.60.0, and with itgolang.org/x/sys0.47.0 → 0.48.0 andgolang.org/x/text0.41.0 → 0.42.0 (all three indirect).go.sum: the matching lines. Tidy also drops checksum lines for versions nothing requires any more (siderolabs/gen0.8.7, Talos machinery 1.14.0 and 1.14.1). The Talos machinery requirement itself stays at 1.14.2.Every workflow that builds this module installs Go from
go.mod, so the first acceptance criterion needs no workflow edit.What I measured, at
a9c39fa7trivy fs --scanners vuln --detection-priority comprehensive)golang.org/x/net(4 high, 7 medium, 1 low, 6 unrated)With Go 1.26.9 on the changed tree:
go build ./...andgo vet ./...pass.go test ./...: 39 packages pass and 1 fails. The failure isscripts/guard-bash-local-initialization, which compares against Bash's English error text; the machine I ran it on uses another language, and the package passes withLC_ALL=C. It is unrelated to this change.scripts/tests/that build the Go tools: 13 pass. The other two fail the same way on unchangedmainwith Go 1.26.6, for local reasons:test-coroot-dns-resolution.shneeds Docker, andtest-talos-render-kernel-args.shran againsttalosctl1.14.2 instead of the pinned 1.13.10.CI will exercise what I could not:
go.modandgo.sumare in the Talos path filter, so the pull request runs the Talos render and compatibility checks with the new Go release.Scope decision:
scripts/render-helm-chartstays on Go 1.26.3A repository-wide scan also lists 38 advisories in that second module, before and after. It is pinned on purpose: it rebuilds the Helm command the way the audited Flux Helm controller was built (Go 1.26.3, Helm 4.2.0) and its guard verifies that build metadata, so it moves only when the audited controller does. Its README describes it as an offline rendering profile.
So the third acceptance criterion should be read as "the root module reports none of these". A repository-wide
trivy fs --scanners vuln .will keep listing the pinned module, and any scan added later needs a recorded exemption for it rather than a version bump.Why nothing caught this here
No check in this repository scans the root module. As far as I can tell from the dependency automation's configuration, it also does not update the module's Go release or its indirect modules; I read the configuration only and did not confirm that against its run history. Closing that gap is a separate piece of work and is not filed yet; it is in my run report for the maintainer to place.
Next step
When review and verification are back under their limits and this is pulled from Ready: run the command above on current
main, open the draft withFixes #4684, and let CI run. The merge queue's production deploy is what delivers it, so queue it only once deploys are healthy.devantler commentedon Oct 15, 2026
Fresh bounded refinement, 15 October: source-level
govulncheckwith the currently declared Go 1.26.6 reports symbol-level paths for 11 distinct advisories and seven non-test command entrypoints in the root module. This adds call-graph evidence to the earlier version-only scan; conservative static reachability is not proof of exploitability, exposure to an attacker, or an incident deadline.The dependency locks and the sampled operational caller bytes are unchanged between the previously validated source and accepted current main
9b7a3c001c9968a0e9b47e167589f2903e129bf5. The existing small root-module upgrade remains relevant. Do not update the independently pinned offline Helm/controller profile as a substitute; it has its own compatibility contract.No dependency, pipeline, credential or production change was made for this refinement, and no additional implementation WIP was opened. Prioritize the root-module repair when it can be pulled under the existing capacity rules, preserving the complete scan and hosted deployment acceptance requirements above.
devantler commentedon Oct 15, 2026
Refinement, 15 October: moved to Ready
The 13:59Z refinement above confirmed the evidence; this records why it is ready to pull and where it ranks.
golang.org/x/netwith 11 known advisories whose code paths it reaches.go mod tidy(tried locally on 10 October), then the normal merge-queue deploy.Set: Priority High, Effort Low, Service class Risk reduction, Ready since 2026-10-15, linked under the security epic #2447.
chore: agent-claim #4684 nonce=858031288d6d838d4602d716ca36c54a
chore: agent-claim #4684 nonce=1db073618036688268b2f86c20812b67