CP-46909: Bump Go toolchain to 1.26.7 - #983
Closed
amfelso wants to merge 1 commit into
Closed
Conversation
The Grype image scan in the DockerBuild workflow began failing on every
open branch on 2026-08-26, after the vulnerability database was rebuilt
(v6.1.9, built 06:18Z). The scan flags six High-severity Go standard
library advisories against the go1.26.5 stdlib recorded in every binary
we ship, all of them fixed in 1.26.6:
GO-2026-5026 GO-2026-5942 GO-2026-5972
GO-2026-6088 GO-2026-6089 GO-2026-6090
The last DockerBuild run on develop predates the database rebuild, so
develop has never been scanned against these advisories. This is not
caused by any dependency change; it blocks all 15 open branches equally.
Implementation Approach:
scripts/ci-checks.sh requires the Go version to agree across every
Dockerfile and every go.mod in the repository. Dependabot can only edit
the Dockerfile it owns, which is why #967 could bump docker/Dockerfile
but failed custom-checks — the go.mod directives disagreed. A coordinated
bump across all seven references is the only shape that satisfies the
check, and it cannot come from Dependabot.
1.26.7 is the current 1.26.x patch release. Staying on the 1.26 series
keeps this a patch-level change; the 1.27.0 bump Dependabot proposed in
#967 is a language minor-version change and is better reviewed on its own.
Functional Requirements:
1. The shipped binaries must record a stdlib version at or above 1.26.6.
Bumped the builder image to golang:1.26.7-alpine in docker/Dockerfile,
tests/docker/Dockerfile.smoke-tests and
tests/integration/test_server/Dockerfile.
2. The Go version must remain consistent repository-wide.
Bumped the go directive to 1.26.7 in go.mod, tests/go.mod,
.tools/go.mod and tests/integration/test_server/go.mod.
Validation:
- scripts/ci-checks.sh passes locally, confirming version consistency.
- Reproduced the original failure locally with grype 0.117.0 against
ghcr.io/cloudzero/untested-cloudzero/untested-cloudzero-agent:pr-982,
confirming all six findings resolve to the stdlib in the built binaries
rather than to any dependency.
- Confirmed golang:1.26.7-alpine exists and carries no High-or-above
findings in the packages that reach the final image.
Supersedes #967.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Greptile SummaryThe PR consistently raises the Go toolchain requirement from 1.26.5 to 1.26.7 across production, tooling, smoke-test, and integration-test builds.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains in the changed toolchain-version references. Important Files Changed
Reviews (2): Last reviewed commit: "CP-46909: Bump Go toolchain to 1.26.7" | Re-trigger Greptile |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the Go toolchain 1.26.5 → 1.26.7 across all 7 references: 4
go.moddirectives and 3 Dockerfiles.One commit, because
scripts/ci-checks.shrequires the version to agree everywhere. Staying on 1.26.x keeps this patch-level.Grype flags six High Go stdlib CVEs (
GO-2026-5026,5942,5972,6088,6089,6090— all fixed in 1.26.6) against the go1.26.5 stdlib compiled into our binaries, failingMerge Docker manifests.This does not fully resolve the Grype failure on its own.
Supersedes #967.