Skip to content

Commit 6865c3a

Browse files
jbeemsterclaude
jbeemster
and
claude
authored
[BEE-1343] Security fix service binary in localstack docker desktop (#109)
* [BEE-1343] Security fix service binary in localstack docker desktop Moves the builder from golang:1.25-alpine to golang:1.26-alpine. Go 1.25 is EOL and the floating tag is stuck at 1.25.14; the three flagged stdlib CVEs are only fixed in 1.26.9 / 1.27.2, so a rebuild alone no longer clears them. The tag stays floating on the 1.26 line so future stdlib CVEs keep self-healing on routine rebuilds. CVE-2026-78667 net/http CVE-2026-78669 net/http/internal/http2 CVE-2026-97031 crypto/tls Bumps golang.org/x/net to v0.60.0, clearing CVE-2026-78669 in the module copy of http2. x/net@v0.60.0 requires go 1.26, which raises the go directive; x/crypto, x/sys and x/text move with it as MVS requirements. Bumps TAG to 2026.10.0. Verified with trivy: service gobinary goes from 5 HIGH to 1 HIGH. The remainder is CVE-2026-55677 against echo v3.3.10+incompatible, which has no fixed version for the v3 module path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Leave version bump and changelog to the release workflow security-rebuild.yml reads TAG from the Makefile as the currently published version and scans that image, then bump-version.sh writes the new TAG and CHANGELOG entry itself. A manual bump to 2026.10.0 would make it scan a tag that was never published. Reverts the Makefile and CHANGELOG changes from the previous commit; the workflow will produce the same 2026.10.0 entry on release. Also updates the README's builder reference to golang:1.26-alpine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
1 parent 4ff33f9 commit 6865c3a

4 files changed

Lines changed: 15 additions & 15 deletions

File tree

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.25-alpine AS builder
1+
FROM golang:1.26-alpine AS builder
22
ENV CGO_ENABLED=0
33
WORKDIR /backend
44
COPY vm/go.* ./

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ To contribute, check out our [issue tracker](https://github.com/localstack/local
6060

6161
Most CVEs reported against this image come from the Go toolchain compiled into
6262
the `service` binary rather than from any dependency manifest, so they are fixed
63-
by rebuilding on a newer `golang:1.25-alpine` rather than by bumping anything.
63+
by rebuilding on a newer `golang:1.26-alpine` rather than by bumping anything.
6464

6565
The [weekly security rebuild](.github/workflows/security-rebuild.yml) does this
6666
automatically: it scans the published image, rebuilds from scratch, and

‎vm/go.mod‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module LocalStack
22

3-
go 1.25.0
3+
go 1.26.0
44

55
require (
66
github.com/labstack/echo v3.3.10+incompatible
@@ -13,8 +13,8 @@ require (
1313
github.com/mattn/go-isatty v0.0.20 // indirect
1414
github.com/valyala/bytebufferpool v1.0.0 // indirect
1515
github.com/valyala/fasttemplate v1.2.2 // indirect
16-
golang.org/x/crypto v0.55.0 // indirect
17-
golang.org/x/net v0.58.0 // indirect
18-
golang.org/x/sys v0.47.0 // indirect
19-
golang.org/x/text v0.41.0 // indirect
16+
golang.org/x/crypto v0.57.0 // indirect
17+
golang.org/x/net v0.60.0 // indirect
18+
golang.org/x/sys v0.48.0 // indirect
19+
golang.org/x/text v0.42.0 // indirect
2020
)

‎vm/go.sum‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,16 +21,16 @@ github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6Kllzaw
2121
github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
2222
github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
2323
github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
24-
golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
25-
golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
26-
golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
27-
golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
24+
golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
25+
golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
26+
golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
27+
golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
2828
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
2929
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
30-
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
31-
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
32-
golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
33-
golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
30+
golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
31+
golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
32+
golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
33+
golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
3434
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
3535
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
3636
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

0 commit comments

Comments
 (0)