Repository navigation
fix(deps): build with Go 1.27.3 to reject distrusted eMudhra intermediates - #1047
Merged
Merged
Conversation
…iates Go 1.27.3 adds a denylist to crypto/x509 (GO-2026-6809, CVE-2026-111943). Certificate verification now rejects any chain that contains one of a small set of distrusted intermediate certificates, including the eMudhra/emSign set. Some system trust stores still accept these certificates, so a binary built with Go 1.27.2 can trust a server that presents one. Both micasa and the relay make outbound HTTPS calls (LLM providers, sync, Stripe), so this check is on their normal code path. govulncheck and osv-scanner fail on every branch until the toolchain moves. The go directive alone does not fix shipped artifacts. Nix builds use nixpkgs' go_1_27, and the relay image uses the golang:1.27-alpine build stage. Both pinned Go 1.27.2, so the flake input and the image digest move together with go.mod. The other image digests move as well, to pick up current CA bundles. This supersedes the open Renovate docker-images update, whose golang digest is already stale. The newest caddy:2-alpine image is still built with Go 1.26.8, which does not have the denylist. Caddy only makes outbound TLS calls to its ACME provider, and the fix must come from an upstream Caddy release. Remove the govulncheck excludes for GO-2026-4599 to GO-2026-4602. Go 1.26.1 fixed them, so they no longer suppress anything. One of them also claimed that micasa does not verify x509 certificates, which is false. Generated with Claude Code (claude-opus-5-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The install and contributor pages said Go 1.26.5 was enough. go.mod already required a Go 1.27 release, and now requires 1.27.3. A user with an older local toolchain gets a toolchain download or an error that the docs did not prepare them for. Generated with Claude Code (claude-opus-5-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cpcloud
added
bug
golangci-lint v2.15.0 bundles exhaustive v0.15.0, which rejects any text after an `//exhaustive:` directive. A trailing `// reason` now counts as an argument, so every `//exhaustive:ignore // reason` line fails with "error parsing comment directives: args not allowed". CI installs the latest golangci-lint, and the updated nixpkgs ships the same version, so lint fails both in CI and locally. The reason now sits on the comment line above the directive. Both lines are in the same comment group, so the directive still applies to the switch below it. golangci-lint shows at most 3 identical issues by default, so CI reported only 3 of the 11 broken directives. Generated with Claude Code (claude-opus-5-5) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cpcloud
enabled auto-merge (squash)
October 23, 2026 10:18
cpcloud
added a commit
that referenced
this pull request
Oct 23, 2026
## Summary - Brings every pinned dependency to its latest release in one PR and supersedes the nine open Renovate PRs (#1046, #1045, #1041, #1038, #1036, #1030, #1029, #1028, #1027). Merging those one at a time would mean nine rounds of `vendorHash` and lockfile conflicts. - **Go:** every module in `go.mod`, direct and indirect, is at its latest version. `mcp-go` stays on v1.3.0. v2.0.0 is on the Go proxy, but upstream tagged it by mistake, deleted the tag, and reverted the path change before releasing v1.3.0. - **Nix:** nixpkgs moves to the Oct 23 `nixos-unstable-small`. - **CI:** action SHAs match the tags in #1041. The inline osv-scanner, trufflehog, and goreleaser pins, which Renovate doesn't track, also move. - **Release tooling:** semantic-release 25.0.9, `@semantic-release/git` 11, and the `conventionalcommits` preset 9.3.1. Preset 10 is out, but it needs conventional-changelog-writer 9, and the stable release-notes-generator bundled with semantic-release still uses writer 8. With preset 10, every release fails at the notes step, so the preset stays on 9.x for now. - **Docs site:** Mermaid 12.2.0, set to the dagre layout and classic look. The two pages with diagrams render the same as on 11 (a pixel diff found under 0.01% changed). - Docker image digests were already current after #1047. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
go.mod, the nixpkgs flake input (Nix builds and CI's govulncheck use its Go), and the relay'sgolang:1.27-alpinebuild image. The distroless, Caddy, and Postgres digests also move to their current tags, which carry newer CA bundles. This replaces chore(deps): update docker-images #1038.latest, and the new nixpkgs) rejects text after//exhaustive:ignore, which failed Lint on every branch. The 11 ignore reasons now sit on the comment line above each directive.caddy:2-alpineimage is still built with Go 1.26.8, which lacks the denylist. Caddy has to ship that fix.Reproduce on main
nix run '.#govulncheck'GO-2026-6809and exits 1.🤖 Generated with Claude Code