🔒 build(go): bump go directive to 1.26.6 so CI ships a patched stdlib - #195
🔒 build(go): bump go directive to 1.26.6 so CI ships a patched stdlib#195konih wants to merge 1 commit into
Conversation
Taskfile.yml derives GOTOOLCHAIN straight from the `go` directive line (sed 's/^go //p'), so a separate `toolchain` line (as used in assent) is ignored here. govulncheck flagged 6 stdlib CVEs (GO-2026-6218/6091/6090/ 6089/5972/5026) fixed in go1.26.6; main's Vulncheck workflow has been red since 2026-08-17 at 6ce4ec4, independent of and blocking the open Dependabot PRs (#193, #194).
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
|
Blocked: this go.mod bump (1.26.5 → 1.26.6) fixes `test`/`vulncheck` but breaks `docker-build` and `e2e (kustomize)`, since `Dockerfile` pins the builder stage to `golang:1.26.5@sha256:...` — now Needs a coordinated bump of the Dockerfile's builder FROM line to `golang:1.26.6` with the correct digest. Running this from an unattended sandboxed sweep with no Docker Hub / WebFetch network access — could not resolve the digest safely (didn't want to drop the digest pin as a workaround, that's a security regression). Left for operator: bump `Dockerfile` line 2 to `golang:1.26.6@sha256:`, then this PR (plus the two blocked Dependabot PRs #193/#194) can go green. |
1 participant
Summary
GOTOOLCHAINstraight from thegodirective line in go.mod (sed 's/^go //p'), sogovulncheckwas scanning against go1.26.5's stdlib.main's Vulncheck workflow has been red since 2026-08-17 (commit6ce4ec4), independent of and blocking the two open Dependabot PRs (⬆️(deps): bump the go-minor-patch group with 2 updates #193, ⬆️(deps): bump the github-actions group with 3 updates #194).godirective from 1.26.5 to 1.26.6 (language level unaffected — patch-only toolchain bump).Test plan
task vuln:check— 0 vulnerabilities (was 6)task test:run— all packages pass, internal/ coverage 92.7% (floor 90%), api/ coverage 92.5% (floor 75%)