security: patch CVE-2026-111943 (eMudhra CA compromise)

Bump Go to 1.26.10 and upgrade Alpine ca-certificates-bundle to 20261020-r0.

Author: andreeleuterio

Dockerfile

@@ -4,17 +4,18 @@
 #
 # Nothing fancy here: we copy in the source code and build on the Alpine Go
 # image. Refer to .dockerignore to get a sense of what we're not going to copy.
-FROM golang:1.26.5-alpine3.23@sha256:622e56dbc11a8cfe87cafa2331e9a201877271cbff918af53d3be315f3da88cc AS builder
+FROM golang:1.26.10-alpine3.23@sha256:a07f231c19b03e6106cf442f02a5bcf262147e744d15b7b5e4b6d81d420c70a0 AS builder
 
 COPY . /src
 WORKDIR /src
 RUN go build ./cmd/src
 
 # This stage should be kept in sync with Dockerfile.release.
-FROM alpine:3.22@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412
+FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
 
 # needed for `src code-intel upload` and `src actions exec`
-RUN apk add --no-cache git
+# ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
+RUN apk add --no-cache git && apk upgrade --no-cache ca-certificates-bundle
 
 COPY --from=builder /src/src /usr/bin/
 ENTRYPOINT ["/usr/bin/src"]

Dockerfile.release

@@ -2,10 +2,11 @@
 # suitable for testing, since it depends on a src binary being at the project
 # root _and_ that src binary being runnable on Alpine. To test this, refer to
 # the main Dockerfile, which should have an identical second stage.
-FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
+FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
 
 # needed for `src code-intel upload` and `src actions exec`
-RUN apk add --no-cache git
+# ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
+RUN apk add --no-cache git && apk upgrade --no-cache ca-certificates-bundle
 
 COPY src /usr/bin/
 ENTRYPOINT ["/usr/bin/src"]

go.mod

@@ -1,6 +1,6 @@
 module github.com/sourcegraph/src-cli
 
-go 1.26.5
+go 1.26.10
 
 require (
 	cloud.google.com/go/storage v1.50.0

mise.toml

@@ -1,4 +1,4 @@
 [tools]
-golang = "1.26.5"
+golang = "1.26.10"
 shfmt = "3.8.0"
 shellcheck = "0.10.0"