From d3e3a4eabf23118cfafce798ca49153bd1bb8fd3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Eleuterio?= Date: Mon, 27 Jul 2026 18:29:57 -0300 Subject: [PATCH] chore: update Go to 1.26.5 Go 1.26.5 fixes CVE-2026-39822 (os: root escape via symlink plus trailing slash on Unix) and CVE-2026-42505 (crypto/tls), both of which are flagged by image scans against binaries built with Go 1.26.4. Updates the Go version in mise.toml (which CI derives its Go version from), go.mod, lib/go.mod, dev/vendor-lib.sh, and the Dockerfile builder image. The golang:1.26.5 Alpine image is only published on Alpine 3.23, so the builder stage moves from alpine3.22 to alpine3.23; the runtime stage is unchanged. ## Test Plan - go build ./cmd/src - go test ./... passes with Go 1.26.5 --- Dockerfile | 2 +- dev/vendor-lib.sh | 2 +- go.mod | 2 +- lib/go.mod | 2 +- mise.toml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 79886b234a..6a1d6bf01d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # # Nothing fancy here: we copy in the source code and build on the Alpine Go # image. Refer to .dockerignore to get a sense of what we're not going to copy. -FROM golang:1.26.4-alpine3.22@sha256:727cfc3c40be55cd1bc9a4a059406b28a059857e3be752aa9d09531e12c20c56 AS builder +FROM golang:1.26.5-alpine3.23@sha256:622e56dbc11a8cfe87cafa2331e9a201877271cbff918af53d3be315f3da88cc AS builder COPY . /src WORKDIR /src diff --git a/dev/vendor-lib.sh b/dev/vendor-lib.sh index 8e22f43238..06db251bd9 100755 --- a/dev/vendor-lib.sh +++ b/dev/vendor-lib.sh @@ -136,7 +136,7 @@ echo "Creating go.mod file..." cat > "$DEST_LIB/go.mod" <