Go Patch Upgrade: 1.26.5 → 1.26.6
Context
New Go stdlib CVEs have been published that affect Go 1.26.5. All PRs across the repo are currently failing govulncheck until we bump to Go 1.26.6. This is a Tier 2 patch bump.
CVEs fixed in Go 1.26.6:
- GO-2026-6218 (net/url)
- GO-2026-6091 (html/template)
- GO-2026-6090 (crypto/tls)
- GO-2026-6089 (net/http)
- GO-2026-5972 (encoding/asn1)
Instructions
Use the acn-go-version-bump skill to perform this patch upgrade. This is a patch bump (not minor), so:
-
Update go directive from 1.26.5 to 1.26.6 in ALL go.mod files:
- Root
go.mod (UPDATE FIRST)
tools-go/go.mod- All sub-module
go.mod files (azure-ipam, azure-ip-masq-merger, azure-iptables-monitor, bpf-prog/ipv6-hp-bpf, cilium-log-collector, cni, crd, dropgz, npm, pkgerrlint, tools/azure-npm-to-cilium-validator, zapai)
-
Update build/images.mk — update the GO_IMG digest (SHA256) to the new Go 1.26.6 image. Use skopeo inspect or read from .github/image-digests/go-image.txt if pre-cached.
-
Update .pipelines/build/scripts/install-go.sh — update DEFAULT_IMAGE SHA to the new Go 1.26.6 digest.
-
Update bpf-prog/ipv6-hp-bpf/linux.Dockerfile — update Go image SHA.
-
Update npm/linux.Dockerfile and npm/windows.Dockerfile — update Go tag from 1.26.5 to 1.26.6.
-
Run make dockerfiles to regenerate all template-based Dockerfiles.
-
Run go build ./... to verify compilation.
-
Do NOT run go mod tidy — it times out in the agent environment. Existing go.sum files remain valid for patch bumps.
-
Do NOT change GOEXPERIMENT settings — patch bumps don't change crypto requirements.
Target Branch
master
PR Title
chore: bump Go 1.26.5 → 1.26.6 (stdlib CVE fixes)
Validation
After changes, verify:
# All go.mod files updated
grep -r "^go " */go.mod go.mod tools-go/go.mod | grep -v vendor
# build/images.mk has new digest
grep "GO_IMG" build/images.mk
# npm Dockerfiles updated
grep "golang:" npm/linux.Dockerfile npm/windows.Dockerfile
Priority
Critical — this unblocks all PRs failing govulncheck across the entire repo.
Go Patch Upgrade: 1.26.5 → 1.26.6
Context
New Go stdlib CVEs have been published that affect Go 1.26.5. All PRs across the repo are currently failing govulncheck until we bump to Go 1.26.6. This is a Tier 2 patch bump.
CVEs fixed in Go 1.26.6:
Instructions
Use the
acn-go-version-bumpskill to perform this patch upgrade. This is a patch bump (not minor), so:Update
godirective from1.26.5to1.26.6in ALLgo.modfiles:go.mod(UPDATE FIRST)tools-go/go.modgo.modfiles (azure-ipam, azure-ip-masq-merger, azure-iptables-monitor, bpf-prog/ipv6-hp-bpf, cilium-log-collector, cni, crd, dropgz, npm, pkgerrlint, tools/azure-npm-to-cilium-validator, zapai)Update
build/images.mk— update theGO_IMGdigest (SHA256) to the new Go 1.26.6 image. Useskopeo inspector read from.github/image-digests/go-image.txtif pre-cached.Update
.pipelines/build/scripts/install-go.sh— updateDEFAULT_IMAGESHA to the new Go 1.26.6 digest.Update
bpf-prog/ipv6-hp-bpf/linux.Dockerfile— update Go image SHA.Update
npm/linux.Dockerfileandnpm/windows.Dockerfile— update Go tag from1.26.5to1.26.6.Run
make dockerfilesto regenerate all template-based Dockerfiles.Run
go build ./...to verify compilation.Do NOT run
go mod tidy— it times out in the agent environment. Existing go.sum files remain valid for patch bumps.Do NOT change GOEXPERIMENT settings — patch bumps don't change crypto requirements.
Target Branch
masterPR Title
chore: bump Go 1.26.5 → 1.26.6 (stdlib CVE fixes)Validation
After changes, verify:
Priority
Critical — this unblocks all PRs failing govulncheck across the entire repo.